Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocsp_responders returns OCSP responder URLs from a certificate's AIA extension as OpensslString, whose Deref<Target = str> wraps the raw bytes with str::from_utf8_unchecked. OpenSSL does not enforce that the underlying IA5String is ASCII, so a certificate with non-UTF-8 bytes in its OCSP accessLocation causes safe Rust code to construct a &str that violates the UTF-8 invariant — resulting in undefined behavior. This vulnerability is fixed in 0.10.79.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2026-42327 rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocsp_responders returns OCSP responder URLs from a ce… https://www.cve.org/CVERecord?id=CVE-2026-42327
Post summary
The passage announces CVE‑2026‑42327 in rust‑openssl, detailing the vulnerable function and affected versions, but provides no evidence of exploitation, patching, or PoC.
CVE-2026-42327 UTF-8 Invariant Violation in rust-openssl X509Ref OCSP Responders Parsing https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42327
Post summary
The text announces CVE‑2026‑42327, a UTF‑8 invariant violation in rust‑openssl’s OCSP responder parsing logic, without providing PoC, exploit code, or remediation details.