CVE-2026-41677 is an out-of-bounds read in the rust-openssl crate. From 0.9.0 until 0.10.78, the PEM password callback APIs did not validate the length the callback returns. OpenSSL 3.x is not affected. NVD scores it 9.1, the project calls it Low. Upgrade to 0.10.78.
What's affected
Per the GitHub advisory for the Cargo crate openssl, versions from 0.9.0 are affected, and 0.10.78 is patched. The advisory says a password callback that returns a value larger than the buffer it was given can cause some versions of OpenSSL to over-read that buffer, and that OpenSSL 3.x is not affected.
The advisory marks the severity as Low, while NVD shows a CVSS 9.1 base score.
How to check if you're exposed
Find the crate and its version:
cargo tree -i openssl
Then check whether your code calls any of the *_from_pem_callback functions. Most applications load keys with the plain functions or pass a fixed password, and do not use a callback. Also check which OpenSSL your build links against. If it is 3.x, the advisory says you are not affected. A free dependency scan shows the crate version in your lockfile.
What to do now
- Update the
opensslcrate to 0.10.78 or later withcargo update -p openssl, and commit the lockfile. - Rebuild and redeploy binaries and container images.
- If you write password callbacks, make sure they never return a length larger than the buffer provided.
- Check whether any dependency pins an older openssl crate and update it.
Why it matters
The record lists CWE-125, out-of-bounds read, and CWE-1284, improper validation of a specified quantity in input. The Rust wrapper trusted a length from user code and passed it to the C library.
The score gap is useful to know. The NVD vector assumes network reach and high impact, while the project rates it Low because it needs a specific callback pattern and an older OpenSSL. Use your reachability findings to set the real urgency, and still fold the update into normal maintenance. The record does not flag this CVE as known exploited.
Quick check
We use OpenSSL 3. Do we still update?
The advisory says 3.x is not affected. Updating the crate is cheap and keeps your audit tools quiet.
Sources
Last reviewed: 19 October 2026.
