{"aliases":["GHSA-r6vc-97x9-63vv"],"categories":["memory-exposure"],"crate":"cryptoki","cves":[],"cvss":0.0,"database_specific":{"severity":""},"date":"2026-09-16","deb_packages":[{"crate_name":"parsec-service","deb_name":"parsec-service","version":"1.5.0+ds-1"}],"description":"`cryptoki` treated the CKA_ALLOWED_MECHANISMS ulValueLen byte count as a\nCK_MECHANISM_TYPE element count. A valid nonempty attribute returned through\nthe safe `Session::get_attributes` API could cause construction of an\nout-of-bounds slice and undefined behavior.\n\nPossible consequences include a process crash or denial of service and\npotential disclosure of adjacent heap words. Upgrade to the fixed patch release\nfor the cryptoki 0.10, 0.11, or 0.12 line.","id":"RUSTSEC-2026-0286","keywords":["pkcs11","out-of-bounds-read","undefined-behavior"],"patched_versions":[">=0.10.1, <0.11.0",">=0.11.1, <0.12.0",">=0.12.1"],"source":"debian_rustsec","title":"Out-of-bounds read when decoding CKA_ALLOWED_MECHANISMS","url":"https://github.com/parallaxsecond/rust-cryptoki/pull/368"}