{"id":"EUVD-2025-0223","revision":"c501ac8057ef417f8e1b0d06227527c8","records":[{"revision":"c501ac8057ef417f8e1b0d06227527c8","observedAt":"2026-11-09T02:15:36.737+00:00","statement":{"source":"euvd","id":"EUVD-2025-0223","aliases":["CVE-2025-24898","GHSA-rpmj-rpgj-qmpm"],"title":"rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions `ssl::select_next_proto` can return a slice pointing into the `server` argument's buffer but with a lifetime bound to the `client` argument. I…","description":"rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions `ssl::select_next_proto` can return a slice pointing into the `server` argument's buffer but with a lifetime bound to the `client` argument. In situations where the `sever` buffer's lifetime is shorter than the `client` buffer's, this can cause a use after free. This could cause the server to crash or to return arbitrary memory contents to the client. The crate`openssl` version 0.10.70 fixes the signature of `ssl::select_next_proto` to properly constrain the output buffer's lifetime to that of both input buffers. Users are advised to upgrade. In standard usage of `ssl::select_next_proto` in the callback passed to `SslContextBuilder::set_alpn_select_callback`, code is only affected if the `server` buffer is constructed *within* the callback.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.3,"severity":null}],"references":["https://github.com/sfackler/rust-openssl/security/advisories/GHSA-rpmj-rpgj-qmpm","https://github.com/sfackler/rust-openssl/pull/2360","https://crates.io/crates/openssl"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-0223","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Feb 3, 2025, 5:57:39 PM","dateUpdated":"Feb 12, 2025, 8:51:24 PM"},"relatedAdvisories":[{"id":"RHSA-2025:7317","title":"Red Hat Security Advisory: python3.12-cryptography security update","vulnerabilityIds":["CVE-2025-24898"]},{"id":"SUSE-SU-2026:23036-1","title":"Security update for libkrun","vulnerabilityIds":["CVE-2025-24898","CVE-2026-41676","CVE-2026-41677","CVE-2026-41678","CVE-2026-41681","CVE-2026-41898","CVE-2026-42327","CVE-2026-44662"]},{"id":"WID-SEC-W-2025-0366","title":"Vaultwarden: Schwachstelle ermöglicht Denial of Service oder Offenlegung von Informationen","vulnerabilityIds":["CVE-2025-24898"]},{"id":"openSUSE-SU-2026:21464-1","title":"Security update for libkrun","vulnerabilityIds":["CVE-2025-24898","CVE-2026-41676","CVE-2026-41677","CVE-2026-41678","CVE-2026-41681","CVE-2026-41898","CVE-2026-42327","CVE-2026-44662"]},{"id":"openSUSE-SU-2025:14814-1","title":"obs-service-cargo-4.5.0-2.1 on GA media","vulnerabilityIds":["CVE-2025-24898"]},{"id":"RHSA-2025:7147","title":"Red Hat Security Advisory: rpm-ostree security update","vulnerabilityIds":["CVE-2025-24898"]},{"id":"RHSA-2025:7313","title":"Red Hat Security Advisory: keylime-agent-rust security update","vulnerabilityIds":["CVE-2025-24898"]},{"id":"msrc_CVE-2025-24898","title":"rust openssl ssl::select_next_proto use after free","vulnerabilityIds":["CVE-2025-24898"]},{"id":"SUSE-SU-2026:23070-1","title":"Security update for libkrun","vulnerabilityIds":["CVE-2025-24898","CVE-2026-41676","CVE-2026-41677","CVE-2026-41678","CVE-2026-41681","CVE-2026-41898","CVE-2026-42327","CVE-2026-44662"]},{"id":"RHSA-2025:7160","title":"Red Hat Security Advisory: bootc security update","vulnerabilityIds":["CVE-2025-24898"]},{"id":"RHSA-2025:7241","title":"Red Hat Security Advisory: rust-bootupd security update","vulnerabilityIds":["CVE-2025-24898"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-0223","identifiers":["EUVD-2025-0223","CVE-2025-24898","GHSA-rpmj-rpgj-qmpm"]},"retained":false,"historicalAffected":[]}],"coverage":[]}