rust-openssl provides OpenSSL bindings for Rust. The vulnerability exists in versions 0.9.24 through 0.10.77, where the FFI trampolines for PSK callbacks and cookie generation forwarded a length returned by the user closure directly to OpenSSL without validating it against the supplied buffer. This unchecked length can cause buffer overflows or unintentional memory disclosure to a connected peer. The weaknesses are represented by CWE-126 and CWE-130.

The affected product is the rust-openssl library used in Rust applications, specifically versions 0.9.24 up to 0.10.77 inclusive. The fix was introduced in release 0.10.78.

The CVSS score of 8.3 indicates a high severity, but the EPSS score of less than 1% suggests a low current probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attacks are likely to involve a Rust application that configures user-defined PSK or cookie callbacks; by providing a closure that returns an overly large length, an attacker could corrupt memory or cause OpenSSL to leak sensitive data to the network peer. The exploitation requires control over the application’s callback implementation, so the threat is moderate but warrants prompt remediation.