CVE-2026-45784: rust-openssl provides OpenSSL bindings for the Rust programming language

Q: How do I fix CVE-2026-45784?

openssl: upgrade to 0.10.80. Exact commands for each OS are on this page.

Q: Is CVE-2026-45784 being exploited?

CVE-2026-45784 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2026-45784 affect?

CVE-2026-45784 affects openssl. Severity is high (CVSS 7.1). rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipher_update_inplace in openssl/src/cipher_ctx.rs incorrectly sized output buffers when used with AES key-wrap-with-padding

Q: How urgent is CVE-2026-45784?

Priority 31/100. High severity; On your watchlist

Routine

HIGH 7.1WATCHLISTUPGRADE

CVE-2026-45784 is a high-severity flaw (CVSS 7.1) affecting openssl. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipher_update_inplace in openssl/src/cipher_ctx.rs incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers EVP_aes_{128,192,256}_wrap_pad. For a non-multiple-of-8 input, OpenSSL writes up to 7 bytes past the end of the caller's buffer or Vec, producing attacker-controllable heap corruption when the plaintex

Why this priority

High severity
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	7.1 (High)
Attack vector	Local
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	0.1% (top 97%)
CISA exploited list	No
Weakness	CWE-131, CWE-787
Published	2026-07-17
Last modified	2026-07-29

Publisher (CNA): GitHub, Inc. · Vendor: sfackler

Last updated 2026-07-29 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-07-17 21:17 UTCPublished CVE record published
2026-07-29 15:43 UTCUpdated Record last modified

sfackler openssl UPGRADE

Affected: >= 0.10.50 and < 0.10.80

Fixed in: 0.10.80

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy openssl || rpm -q openssl || openssl --version

2. UPGRADE to 0.10.80 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade openssl

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade openssl

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-45784?

openssl: upgrade to 0.10.80. Exact commands for each OS are on this page.

Is CVE-2026-45784 being exploited?

CVE-2026-45784 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-45784 affect?

CVE-2026-45784 affects openssl. Severity is high (CVSS 7.1). rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipher_update_inplace in openssl/src/cipher_ctx.rs incorrectly sized output buffers when used with AES key-wrap-with-padding

How urgent is CVE-2026-45784?

Priority 31/100. High severity; On your watchlist

Software pages

OpenSSL vulnerabilities

Related CVEs

CVE-2026-84784 HIGH 7.5 UPGRADE Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoidin
CVE-2026-84783 HIGH 7.5 UPGRADE Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached
CVE-2026-84782 HIGH 8.2 UPGRADE Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspe
CVE-2026-77696 LOW 3.7 UPGRADE Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing s
CVE-2026-75806 MEDIUM 5.3 UPGRADE Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single un

References

← Back to latest CVEs