Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 26 October 2026.

Which products and versions are affected?

rustls-ffi (crates.io) SEMVER:introduced=0.12.0,fixed=0.15.7; Rustls-Ffi 0.12.0 through 0.15.6.

Is there a fix for This vulnerability?

Yes. rustls-ffi (crates.io): upgrade to 0.15.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked with local access, in a software library.

Check whether you run rustls-ffi (crates.io) or Rustls-Ffi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

rustls-ffi use-after-free in client connection constructors

Severity: info · Published 2026-10-26

rustls-ffi is a Rust library providing TLS (transport layer security) encryption for applications. A memory safety bug in versions 0.12.0 through 0.15.6 causes the library to retain a pointer to a caller-supplied server name buffer after the function returns, rather than making its own copy. If an application frees or reuses that buffer, the library may later read from deallocated memory, potentially causing a crash or allowing information disclosure.

Vendors: crates.io, Rustls.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 26 October 2026.
Which products and versions are affected?: rustls-ffi (crates.io) SEMVER:introduced=0.12.0,fixed=0.15.7; Rustls-Ffi 0.12.0 through 0.15.6.
Is there a fix for This vulnerability?: Yes. rustls-ffi (crates.io): upgrade to 0.15.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked with local access, in a software library.
Am I affected?: Check whether you run rustls-ffi (crates.io) or Rustls-Ffi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

rustls-ffi (crates.io): upgrade to 0.15.7 or later
```
cargo update -p rustls-ffi
```

Technical details

The rustls_client_connection_new() and rustls_client_connection_new_alpn() functions store a reference to the caller-owned server_name buffer instead of copying it, creating a use-after-free vulnerability when the caller deallocates or reuses the buffer. This affects language bindings and applications passing temporary strings; callers maintaining the buffer lifetime are unaffected. Version 0.15.7 and later fix this by copying the input buffer instead of retaining a reference.

Affected products

rustls rustls-ffi 0.12.0 through 0.15.6

Identifiers

GHSA-rc3f-4j82-cmrg
RUSTSEC-2026-0413

Timeline

2026-10-26: disclosed
2026-10-27: advisory
2026-10-27: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.