CVE-2023-53159

2026-10-03T00:47:10.321918+00:00

Affected: sfackler openssl

The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host.

GHSA-xcf7-rvmh-g6q4 — `openssl` `X509VerifyParamRef::set_host` buffer over-read

2026-10-03T00:47:10.321999+00:00

Affected: crates.io: openssl

When this function was passed an empty string, `openssl` would attempt to call `strlen` on it, reading arbitrary memory until it reached a NUL byte.