The Rust OpenSSL Project maintains a Rust-language binding to the widely used OpenSSL cryptographic library, placing it in a critical position within the Rust ecosystem where it acts as a bridge between memory-safe Rust applications and OpenSSL's native C implementation. Despite a narrow product footprint, this binding is embedded across numerous downstream Rust projects and services, amplifying the significance of any vulnerability in the wrapper itself. Defenders tracking Rust applications that depend on TLS or cryptographic operations should monitor this vendor's releases and coordinate patching with their upstream OpenSSL tracking; live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Rust Openssl Project over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-41678HIGH rust-openssl provides OpenSSL bindings for the Rust programming language. From to before 0.10.78, aes::unwrap_key() contains an incorrect assertion: it checks that out.len() + 8 | Apr 24, 2026 | 8.1 | 34 | NO | NO |
CVE-2026-41677CRITICAL rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.0 to before 0.10.78, the *_from_pem_callback APIs did not validate the length returned by the us | Apr 24, 2026 | 9.1 | 33 | NO | NO |
CVE-2026-41676HIGH rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes i | Apr 24, 2026 | 7.5 | 33 | NO | NO |
CVE-2026-41681HIGH rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.39 to before 0.10.78, EVP_DigestFinal() always writes EVP_MD_CTX_size(ctx) to the out buffer. I | Apr 24, 2026 | 7.5 | 32 | NO | NO |
CVE-2018-20997CRITICAL An issue was discovered in the openssl crate before 0.10.9 for Rust. A use-after-free occurs in CMS Signing. | Aug 26, 2019 | 9.8 | 29 | NO | NO |
CVE-2026-41898MEDIUM rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.24 to before 0.10.78, the FFI trampolines behind SslContextBuilder::set_psk_client_callback, set | Apr 24, 2026 | 5.3 | 27 | NO | NO |
CVE-2016-10931HIGH An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there | Aug 26, 2019 | 8.1 | 24 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Rust Openssl Project.
Media articles that mention a CVE ID that affects a product developed by Rust Openssl Project — matched by CVE ID, not by vendor name.