Description
rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions `ssl::select_next_proto` can return a slice pointing into the `server` argument's buffer but with a lifetime bound to the `client` argument. In situations where the `sever` buffer's lifetime is shorter than the `client` buffer's, this can cause a use after free. This could cause the server to crash or to return arbitrary memory contents to the client. The crate`openssl` version 0.10.70 fixes the signature of `ssl::select_next_proto` to properly constrain the output buffer's lifetime to that of both input buffers. Users are advised to upgrade. In standard usage of `ssl::select_next_proto` in the callback passed to `SslContextBuilder::set_alpn_select_callback`, code is only affected if the `server` buffer is constructed *within* the callback.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sfackler | rust-openssl | >= 0.10.0, < 0.10.70 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rust-openssl | 0.10.70-1 | — |
| Debian 13 | rust-openssl | 0.10.70-1 | — |
| Debian 12 | rust-openssl | No fix yet | — |
| Debian 11 | rust-openssl | 0.10.29-1+deb11u1 | DLA-4049-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | rust-openssl | 0.10.57-1ubuntu0.1~esm1 | USN-7891-1 |
| Ubuntu Pro 22.04 LTS | rust-openssl | 0.10.36-1ubuntu0.1~esm1 | USN-7891-1 |
| Ubuntu Pro 20.04 LTS | rust-openssl | 0.10.23-1ubuntu0.1~esm1 | USN-7891-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | bootc +1 | 1.1.6-3.el9_6 | RHSA-2025:7160 |
| RHEL 9 | bootupd +1 | 0.2.27-3.el9 | RHSA-2025:7241 |
| RHEL 9 | keylime-agent-rust | 0.2.2-2.el9 | RHSA-2025:7313 |
| RHEL 9 | python3.12-cryptography | 41.0.7-2.el9 | RHSA-2025:7317 |
| RHEL 9 | rpm-ostree +1 | 2025.5-1.el9 | RHSA-2025:7147 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | bootc +1 | 1.1.6-3.el9_6 | ALSA-2025:7160 |
| AlmaLinux 9 | bootupd | 0.2.27-3.el9 | ALSA-2025:7241 |
| AlmaLinux 9 | keylime-agent-rust | 0.2.2-2.el9 | ALSA-2025:7313 |
| AlmaLinux 9 | python3.12-cryptography | 41.0.7-2.el9 | ALSA-2025:7317 |
| AlmaLinux 9 | rpm-ostree +1 | 2025.5-1.el9 | ALSA-2025:7147 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | bootc | 1.1.6-3.el9_6 | RLSA-2025:7160 |
| Rocky Linux 9 | keylime-agent-rust | 0.2.2-2.el9 | RLSA-2025:7313 |
| Rocky Linux 9 | python3.12-cryptography | 41.0.7-2.el9 | RLSA-2025:7317 |
| Rocky Linux 9 | rust-bootupd | 0.2.27-3.el9 | RLSA-2025:7241 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.1 | libkrun | 1.4.10-slfo.1.1_2.1 | SUSE-SU-2026:23070-1 |
| SLE Micro 6.0 | libkrun | 1.4.10-2.1 | SUSE-SU-2026:23036-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | obs-service-cargo | 4.5.0-2.1 | openSUSE-SU-2025:14814-1 |
| openSUSE Leap 16.0 | libkrun | 1.4.10-160000.3.1 | openSUSE-SU-2026:21464-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | 389-ds-base | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | bootc +1 | 1.1.6-3.el9_6 | ELSA-2025-7160 |
| Oracle Linux 9 | bootupd | 0.2.27-3.el9 | ELSA-2025-7241 |
| Oracle Linux 9 | keylime-agent-rust | 0.2.2-2.el9 | ELSA-2025-7313 |
| Oracle Linux 9 | python3.12-cryptography | 41.0.7-2.el9 | ELSA-2025-7317 |
| Oracle Linux 9 | rpm-ostree +1 | 2025.5-1.el9 | ELSA-2025-7147 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | berg | 0.4.7-r1 | — |
| Wolfi rolling | linkerd-extension-init | 0.1.2-r1 | — |
| Wolfi rolling | linkerd2 | 25.1.2-r1 | — |
| Wolfi rolling | lychee | 0.18.0-r1 | — |
| Wolfi rolling | nushell +1 | 0.102.0-r0 | — |
| Wolfi rolling | rustup | 1.27.1-r5 | — |
| Wolfi rolling | sccache | 0.9.1-r1 | — |
| Wolfi rolling | sdp-k8s-injector +1 | 1.3.7-r5 | — |
| Wolfi rolling | zed | 0.171.6-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | openssl | >= 0.10.0, < 0.10.70 | 0.10.70 | GHSA-rpmj-rpgj-qmpm |
| crates.io | openssl | >= 0.0.0-0, < 0.10.70 | 0.10.70 | RUSTSEC-2025-0004 |
Advisories 26
- ALSA-2025:7241 Moderate: rust-bootupd security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:7313 Moderate: keylime-agent-rust security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:7317 Moderate: python3.12-cryptography security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:7147 Moderate: rpm-ostree security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:7160 Moderate: bootc security update AlmaLinux Security Advisories · Oct 29, 2026
- USN-7891-1 rust-openssl vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
- RHSA-2025:7313 Red Hat Security Advisory: keylime-agent-rust security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:7317 Red Hat Security Advisory: python3.12-cryptography security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:7160 Red Hat Security Advisory: bootc security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:7241 Red Hat Security Advisory: rust-bootupd security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:7147 Red Hat Security Advisory: rpm-ostree security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- SUSE-SU-2026:23070-1 Security update for libkrun SUSE / openSUSE Security Updates · Aug 14, 2026
- SUSE-SU-2026:23036-1 Security update for libkrun SUSE / openSUSE Security Updates · Aug 12, 2026
- WID-SEC-2025-0366 Vaultwarden: Schwachstelle ermöglicht Denial of Service oder Offenlegung von Informationen BSI CERT-Bund (WID) · Aug 11, 2026
- openSUSE-SU-2026:21464-1 Security update for libkrun SUSE / openSUSE Security Updates · Jul 30, 2026
- DLA-4049-1 rust-openssl - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2025:14814-1 obs-service-cargo-4.5.0-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- RLSA-2025:7317 Moderate: python3.12-cryptography security update Rocky Linux Security Advisories · Oct 7, 2025
- RLSA-2025:7313 Moderate: keylime-agent-rust security update Rocky Linux Security Advisories · Oct 4, 2025
- RLSA-2025:7160 Moderate: bootc security update Rocky Linux Security Advisories · Oct 4, 2025
- RLSA-2025:7241 Moderate: rust-bootupd security update Rocky Linux Security Advisories · Oct 4, 2025
- ELSA-2025-7241 Moderate: rust-bootupd security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 16, 2025
- ELSA-2025-7160 Moderate: bootc security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 16, 2025
- ELSA-2025-7147 Moderate: rpm-ostree security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 16, 2025
- ELSA-2025-7317 Moderate: python3.12-cryptography security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 16, 2025
- ELSA-2025-7313 Moderate: keylime-agent-rust security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 16, 2025