Reported

April 19, 2026

Issued

November 10, 2026

Package

openssl (crates.io)

Type

Vulnerability

Categories

• memory-corruption

Keywords

#digest #buffer-overflow

Aliases

• CVE-2026-41681
• GHSA-ghm9-cr32-g9qj

References

• https://github.com/rust-openssl/rust-openssl/pull/2608

Patched

• >=0.10.78

Unaffected

• <0.10.39

Affected Functions

Version

openssl::md_ctx::MdCtxRef::digest_final

• >=0.10.39, <0.10.78

Description

MdCtxRef::digest_final passed the caller's output slice to OpenSSL's EVP_DigestFinal without checking its length. EVP_DigestFinal always writes the full digest (EVP_MD_CTX_size bytes), so an output slice shorter than the digest is overrun. With a stack buffer this usually corrupts the stack. The overflow is reachable from safe code.

MdCtxRef was added in 0.10.39. 0.10.78 checks the slice length first and returns an error when the slice is too short for the digest.

Advisory available under CC0-1.0 license.