GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    Related vulnerabilities

    RUSTSEC-2026-0286 (GHSA-R6VC-97X9-63VV)

    Vulnerability from osv_rustsec – Published: 2026-09-16 12:00 – Updated: 2026-09-17 07:37 – Source website
    VLAI
    Summary
    Out-of-bounds read when decoding CKA_ALLOWED_MECHANISMS
    Details

    cryptoki treated the CKA_ALLOWED_MECHANISMS ulValueLen byte count as a CK_MECHANISM_TYPE element count. A valid nonempty attribute returned through the safe Session::get_attributes API could cause construction of an out-of-bounds slice and undefined behavior.

    Possible consequences include a process crash or denial of service and potential disclosure of adjacent heap words. Upgrade to the fixed patch release for the cryptoki 0.10, 0.11, or 0.12 line.

    References
    To clipboard 

    {
  "affected": [
    {
      "database_specific": {
        "categories": [
          "memory-exposure"
        ],
        "cvss": null,
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "cryptoki",
        "purl": "pkg:cargo/cryptoki"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.10.1"
            },
            {
              "introduced": "0.11.0"
            },
            {
              "fixed": "0.11.1"
            },
            {
              "introduced": "0.12.0"
            },
            {
              "fixed": "0.12.1"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "GHSA-r6vc-97x9-63vv"
  ],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "`cryptoki` treated the CKA_ALLOWED_MECHANISMS ulValueLen byte count as a\nCK_MECHANISM_TYPE element count. A valid nonempty attribute returned through\nthe safe `Session::get_attributes` API could cause construction of an\nout-of-bounds slice and undefined behavior.\n\nPossible consequences include a process crash or denial of service and\npotential disclosure of adjacent heap words. Upgrade to the fixed patch release\nfor the cryptoki 0.10, 0.11, or 0.12 line.",
  "id": "RUSTSEC-2026-0286",
  "modified": "2026-09-17T07:37:14Z",
  "published": "2026-09-16T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/cryptoki"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0286.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/parallaxsecond/rust-cryptoki/pull/368"
    }
  ],
  "related": [],
  "severity": [],
  "summary": "Out-of-bounds read when decoding CKA_ALLOWED_MECHANISMS"
}