https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-41898.htmlhttps://patchthecve.com/cve/CVE-2026-41898.htmlWed, 15 Jul 2026 16:17:15 +0000MEDIUM 5.3: rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.24 to before 0.10.78, the FFI trampolines behind SslContextBuilder::set_psk_client_callback, set_psk_server_callback, set_cookie_generate_cb, and set_stateless_cookie_generate_cb forwarded the user closure's returnedhttps://patchthecve.com/cve/CVE-2026-41681.htmlhttps://patchthecve.com/cve/CVE-2026-41681.htmlWed, 15 Jul 2026 16:51:48 +0000HIGH 7.5: rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.39 to before 0.10.78, EVP_DigestFinal() always writes EVP_MD_CTX_size(ctx) to the out buffer. If out is smaller than that, MdCtxRef::digest_final() writes past its end, usually corrupting the stack. This is reachablhttps://patchthecve.com/cve/CVE-2026-41678.htmlhttps://patchthecve.com/cve/CVE-2026-41678.htmlFri, 17 Jul 2026 19:24:37 +0000HIGH 8.1: rust-openssl provides OpenSSL bindings for the Rust programming language. From to before 0.10.78, aes::unwrap_key() contains an incorrect assertion: it checks that out.len() + 8 <= in_.len(), but this condition is reversed. The intended invariant is out.len() >= in_.len() - 8, ensuring the output https://patchthecve.com/cve/CVE-2026-41677.htmlhttps://patchthecve.com/cve/CVE-2026-41677.htmlWed, 17 Jun 2026 10:46:59 +0000CRITICAL 9.1: rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.0 to before 0.10.78, the *_from_pem_callback APIs did not validate the length returned by the user's callback. A password callback that returns a value larger than the buffer it was given can cause some versions of Ohttps://patchthecve.com/cve/CVE-2026-41676.htmlhttps://patchthecve.com/cve/CVE-2026-41676.htmlWed, 15 Jul 2026 16:17:18 +0000HIGH 7.5: rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-e