Reported

May 16, 2026

Issued

November 10, 2026

Package

openssl (crates.io)

Type

Vulnerability

Categories

• memory-corruption

Keywords

#aes #key-wrap #cipher #buffer-overflow

Aliases

• CVE-2026-45784
• GHSA-phqj-4mhp-q6mq

References

• https://github.com/rust-openssl/rust-openssl/pull/2638

Patched

• >=0.10.80

Unaffected

• <0.10.50

Affected Functions

Version

openssl::cipher_ctx::CipherCtxRef::cipher_update_inplace

• >=0.10.50, <0.10.80

Description

CipherCtxRef::cipher_update_inplace had the same sizing error that 0.10.79 fixed in cipher_update (GHSA-xv59-967r-8726); that fix missed this method. It required room for inlen + block_size bytes, but with the AES key-wrap-with-padding ciphers OpenSSL writes up to 7 more bytes when inlen is not a multiple of 8, past the end of data.

Only users of the AES key-wrap-with-padding ciphers are affected. cipher_update_inplace was added in 0.10.50, and 0.10.80 applies the corrected size check to it.

Advisory available under CC0-1.0 license.