# openssl (crates.io) vulnerabilities Source: https://junglewise.ai/threats/technologies/crates-io-openssl Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 00:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/crates-io-openssl.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 25 vulnerabilities in openssl (crates.io): 0 in the last 7 days and 0 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-45784, was published on 17 July 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 25 (2 critical, 0 exploited in the wild) ## About openssl (crates.io) Rust bindings for OpenSSL providing cryptographic functions and TLS protocol support. ## Latest openssl (crates.io) vulnerabilities - [CVE-2026-45784: rust-openssl heap overflow in CipherCtxRef::cipher_update_inplace](https://junglewise.ai/threats/cve-2026-45784-rust-openssl-heap-overflow-in-cipherctxref-cipher-update-inplace) (medium, CVSS 4, published 17 Jul 2026) - [CVE-2026-44662: rust-openssl heap buffer overflow in AES key-wrap-with-padding](https://junglewise.ai/threats/cve-2026-44662-rust-openssl-heap-buffer-overflow-in-aes-key-wrap-with-padding) (medium, CVSS 4, published 14 May 2026) - [CVE-2026-42327: rust-openssl undefined behavior in X509Ref::ocsp_responders](https://junglewise.ai/threats/cve-2026-42327-rust-openssl-undefined-behavior-in-x509ref-ocsp-responders) (high, CVSS 4, published 14 May 2026) - [CVE-2026-41898: rust-openssl buffer over-read in PSK and cookie callbacks](https://junglewise.ai/threats/cve-2026-41898-rust-openssl-buffer-over-read-in-psk-and-cookie-callbacks) (high, CVSS 5.3, published 24 Apr 2026) - [CVE-2026-41681: rust-openssl stack buffer overflow in MdCtxRef::digest_final](https://junglewise.ai/threats/cve-2026-41681-rust-openssl-stack-buffer-overflow-in-mdctxref-digest-final) (critical, CVSS 9.8, published 24 Apr 2026) - [CVE-2026-41678: rust-openssl out-of-bounds write in aes::unwrap_key](https://junglewise.ai/threats/cve-2026-41678-rust-openssl-out-of-bounds-write-in-aes-unwrap-key) (high, CVSS 8.1, published 24 Apr 2026) - [CVE-2026-41677: rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length](https://junglewise.ai/threats/cve-2026-41677-rust-opennssl-has-an-out-of-bounds-read-in-pem-password-callback) (critical, CVSS 9.1, published 24 Apr 2026) - [CVE-2026-41676: rust-openssl buffer overflow in Deriver::derive](https://junglewise.ai/threats/cve-2026-41676-rust-openssl-buffer-overflow-in-deriver-derive) (high, CVSS 7.5, published 24 Apr 2026) - [Duplicate Advisory: `openssl` `X509VerifyParamRef::set_host` buffer over-read](https://junglewise.ai/threats/duplicate-advisory-openssl-x509verifyparamref-set-host-buffer-over-read-b24aefb6) (low, CVSS 3.1, published 28 Jul 2025) - [rust-openssl Use-After-Free in `Md::fetch` and `Cipher::fetch`](https://junglewise.ai/threats/rust-openssl-use-after-free-in-md-fetch-and-cipher-fetch-b7e7dd01) (medium, CVSS 4, published 4 Apr 2025) - [RUSTSEC-2025-0022 - Use-After-Free in `Md::fetch` and `Cipher::fetch`](https://junglewise.ai/threats/rustsec-2025-0022-use-after-free-in-md-fetch-and-cipher-fetch-1c473b89) (info, published 4 Apr 2025) - [CVE-2025-24898: RUSTSEC-2025-0004 - ssl::select_next_proto use after free](https://junglewise.ai/threats/cve-2025-24898-rust-openssl-ssl-select-next-proto-use-after-free) (medium, CVSS 4, published 2 Feb 2025) - [openssl's `MemBio::get_buf` has undefined behavior with empty buffers](https://junglewise.ai/threats/openssl-s-membio-get-buf-has-undefined-behavior-with-empty-buffers-463bbd74) (low, CVSS 3.1, published 22 Jul 2024) - [RUSTSEC-2024-0357 - `MemBio::get_buf` has undefined behavior with empty buffers](https://junglewise.ai/threats/rustsec-2024-0357-membio-get-buf-has-undefined-behavior-with-empty-cdd3fe86) (info, published 21 Jul 2024) - [`openssl` `X509StoreRef::objects` is unsound](https://junglewise.ai/threats/openssl-x509storeref-objects-is-unsound-c3070164) (info, published 28 Nov 2023) - [RUSTSEC-2023-0072 - `openssl` `X509StoreRef::objects` is unsound](https://junglewise.ai/threats/rustsec-2023-0072-openssl-x509storeref-objects-is-unsound-12c21511) (info, published 23 Nov 2023) - [CVE-2023-53159: RUSTSEC-2023-0044 - `openssl` `X509VerifyParamRef::set_host` buffer over-read](https://junglewise.ai/threats/cve-2023-53159-openssl-x509verifyparamref-set-host-buffer-over-read) (low, CVSS 3.1, published 20 Jun 2023) - [`openssl` `X509NameBuilder::build` returned object is not thread safe](https://junglewise.ai/threats/openssl-x509namebuilder-build-returned-object-is-not-thread-safe-c8567f59) (info, published 24 Mar 2023) - [`openssl` `SubjectAlternativeName` and `ExtendedKeyUsage::other` allow arbitrary file read](https://junglewise.ai/threats/openssl-subjectalternativename-and-extendedkeyusage-other-allow-5005afcd) (info, published 24 Mar 2023) - [`openssl` `X509Extension::new` and `X509Extension::new_nid` null pointer dereference](https://junglewise.ai/threats/openssl-x509extension-new-and-x509extension-new-nid-null-pointer-2a711e9b) (info, published 24 Mar 2023) - [RUSTSEC-2023-0024 - `openssl` `X509Extension::new` and `X509Extension::new_nid` null pointer dereference](https://junglewise.ai/threats/rustsec-2023-0024-openssl-x509extension-new-and-x509extension-new-nid-256004e6) (info, published 24 Mar 2023) - [RUSTSEC-2023-0023 - `openssl` `SubjectAlternativeName` and `ExtendedKeyUsage::other` allow arbitrary file read](https://junglewise.ai/threats/rustsec-2023-0023-openssl-subjectalternativename-and-extendedkeyusage-6623624d) (info, published 24 Mar 2023) - [RUSTSEC-2023-0022 - `openssl` `X509NameBuilder::build` returned object is not thread safe](https://junglewise.ai/threats/rustsec-2023-0022-openssl-x509namebuilder-build-returned-object-is-not-eebae594) (info, published 24 Mar 2023) - [CVE-2018-20997: RUSTSEC-2018-0010 - Use after free in CMS Signing](https://junglewise.ai/threats/cve-2018-20997-use-after-free-in-openssl) (low, CVSS 3, published 1 Jun 2018) - [CVE-2016-10931: RUSTSEC-2016-0001 - SSL/TLS MitM vulnerability due to insecure defaults](https://junglewise.ai/threats/cve-2016-10931-improper-certificate-validation-in-openssl) (low, CVSS 3, published 5 Nov 2016) ## Most severe openssl (crates.io) vulnerabilities - [CVE-2026-41681: rust-openssl stack buffer overflow in MdCtxRef::digest_final](https://junglewise.ai/threats/cve-2026-41681-rust-openssl-stack-buffer-overflow-in-mdctxref-digest-final) (critical, CVSS 9.8, published 24 Apr 2026) - [CVE-2026-41677: rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length](https://junglewise.ai/threats/cve-2026-41677-rust-opennssl-has-an-out-of-bounds-read-in-pem-password-callback) (critical, CVSS 9.1, published 24 Apr 2026) - [CVE-2026-41678: rust-openssl out-of-bounds write in aes::unwrap_key](https://junglewise.ai/threats/cve-2026-41678-rust-openssl-out-of-bounds-write-in-aes-unwrap-key) (high, CVSS 8.1, published 24 Apr 2026) - [CVE-2026-41676: rust-openssl buffer overflow in Deriver::derive](https://junglewise.ai/threats/cve-2026-41676-rust-openssl-buffer-overflow-in-deriver-derive) (high, CVSS 7.5, published 24 Apr 2026) - [CVE-2026-41898: rust-openssl buffer over-read in PSK and cookie callbacks](https://junglewise.ai/threats/cve-2026-41898-rust-openssl-buffer-over-read-in-psk-and-cookie-callbacks) (high, CVSS 5.3, published 24 Apr 2026) - [CVE-2026-42327: rust-openssl undefined behavior in X509Ref::ocsp_responders](https://junglewise.ai/threats/cve-2026-42327-rust-openssl-undefined-behavior-in-x509ref-ocsp-responders) (high, CVSS 4, published 14 May 2026) - [CVE-2025-24898: RUSTSEC-2025-0004 - ssl::select_next_proto use after free](https://junglewise.ai/threats/cve-2025-24898-rust-openssl-ssl-select-next-proto-use-after-free) (medium, CVSS 4, published 2 Feb 2025) - [CVE-2026-44662: rust-openssl heap buffer overflow in AES key-wrap-with-padding](https://junglewise.ai/threats/cve-2026-44662-rust-openssl-heap-buffer-overflow-in-aes-key-wrap-with-padding) (medium, CVSS 4, published 14 May 2026) - [CVE-2026-45784: rust-openssl heap overflow in CipherCtxRef::cipher_update_inplace](https://junglewise.ai/threats/cve-2026-45784-rust-openssl-heap-overflow-in-cipherctxref-cipher-update-inplace) (medium, CVSS 4, published 17 Jul 2026) - [rust-openssl Use-After-Free in `Md::fetch` and `Cipher::fetch`](https://junglewise.ai/threats/rust-openssl-use-after-free-in-md-fetch-and-cipher-fetch-b7e7dd01) (medium, CVSS 4, published 4 Apr 2025) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other crates.io technologies - [surrealdb (crates.io)](https://junglewise.ai/threats/technologies/surrealdb): 83 vulnerabilities - [wasmtime (crates.io)](https://junglewise.ai/threats/technologies/wasmtime): 67 vulnerabilities - [deno (crates.io)](https://junglewise.ai/threats/technologies/deno): 39 vulnerabilities - [zebrad (crates.io)](https://junglewise.ai/threats/technologies/zebrad): 27 vulnerabilities - [russh (crates.io)](https://junglewise.ai/threats/technologies/crates-io-russh): 26 vulnerabilities - [openssl-src (crates.io)](https://junglewise.ai/threats/technologies/openssl-src): 26 vulnerabilities - [rustfs (crates.io)](https://junglewise.ai/threats/technologies/rustfs): 25 vulnerabilities - [coreutils (crates.io)](https://junglewise.ai/threats/technologies/crates-io-coreutils): 21 vulnerabilities - [ckb (crates.io)](https://junglewise.ai/threats/technologies/ckb): 19 vulnerabilities - [apollo-router (crates.io)](https://junglewise.ai/threats/technologies/apollo-router): 13 vulnerabilities - [deepseek-tui (crates.io)](https://junglewise.ai/threats/technologies/deepseek-tui): 13 vulnerabilities - [diesel (crates.io)](https://junglewise.ai/threats/technologies/diesel): 13 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "openssl (crates.io) vulnerabilities", https://junglewise.ai/threats/technologies/crates-io-openssl, 12 November 2026.