rustsec-2026-0286
debian_rustsec
Description
`cryptoki` treated the CKA_ALLOWED_MECHANISMS ulValueLen byte count as a CK_MECHANISM_TYPE element count. A valid nonempty attribute returned through the safe `Session::get_attributes` API could cause construction of an out-of-bounds slice and undefined behavior. Possible consequences include a process crash or denial of service and potential disclosure of adjacent heap words. Upgrade to the fixed patch release for the cryptoki 0.10, 0.11, or 0.12 line.
Timeline
- Published
- unknown
- Last Modified
- unknown
CVSS Details
CVSS details not available.
Affected Products
No product information available.
References
No references available.
Linked Vulnerabilities
No linked vulnerabilities found.
{
"aliases": [
"GHSA-r6vc-97x9-63vv"
],
"categories": [
"memory-exposure"
],
"crate": "cryptoki",
"cves": [],
"cvss": 0.0,
"database_specific": {
"severity": ""
},
"date": "2026-09-16",
"deb_packages": [
{
"crate_name": "parsec-service",
"deb_name": "parsec-service",
"version": "1.5.0+ds-1"
}
],
"description": "`cryptoki` treated the CKA_ALLOWED_MECHANISMS ulValueLen byte count as a\nCK_MECHANISM_TYPE element count. A valid nonempty attribute returned through\nthe safe `Session::get_attributes` API could cause construction of an\nout-of-bounds slice and undefined behavior.\n\nPossible consequences include a process crash or denial of service and\npotential disclosure of adjacent heap words. Upgrade to the fixed patch release\nfor the cryptoki 0.10, 0.11, or 0.12 line.",
"id": "RUSTSEC-2026-0286",
"keywords": [
"pkcs11",
"out-of-bounds-read",
"undefined-behavior"
],
"patched_versions": [
">=0.10.1, <0.11.0",
">=0.11.1, <0.12.0",
">=0.12.1"
],
"source": "debian_rustsec",
"title": "Out-of-bounds read when decoding CKA_ALLOWED_MECHANISMS",
"url": "https://github.com/parallaxsecond/rust-cryptoki/pull/368"
}