Reported

April 19, 2026

Issued

November 10, 2026

Package

openssl (crates.io)

Type

Vulnerability

Categories

• memory-corruption

Keywords

#derive #x25519 #x448 #hkdf #buffer-overflow

Aliases

• CVE-2026-41676
• GHSA-pqf5-4pqq-29f5

References

• https://github.com/rust-openssl/rust-openssl/pull/2606

Patched

• >=0.10.78

Unaffected

• <0.9.27

Affected Functions

Version

openssl::derive::Deriver::derive

• >=0.9.27, <0.10.78

openssl::pkey_ctx::PkeyCtxRef::derive

• >=0.9.27, <0.10.78

Description

Deriver::derive and PkeyCtxRef::derive pass the length of the caller's buffer to EVP_PKEY_derive and rely on OpenSSL to write no more than that. With OpenSSL 1.1.x, the X25519, X448 and HKDF-extract implementations ignore the length they are given and always write the whole result, so a buffer shorter than the shared secret or derived key is overrun. The overflow is reachable from safe code.

OpenSSL 3.x checks the length itself and is not affected. From 0.10.78, when built against OpenSSL 1.1.x or LibreSSL, both functions derive into a temporary buffer of the required size whenever the caller's buffer is too short, and copy only what fits.

Advisory available under CC0-1.0 license.