{"id":"RUSTSEC-2025-0004","revision":"5745fbbda6f6434db3d484625a786746","records":[{"revision":"5745fbbda6f6434db3d484625a786746","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2025-0004","aliases":["CVE-2025-24898","GHSA-rpmj-rpgj-qmpm"],"title":"ssl::select_next_proto use after free","description":"In `openssl` versions before `0.10.70`, `ssl::select_next_proto` can return a slice pointing into the `server` argument's buffer but with a lifetime bound to the `client` argument. In situations where the `server` buffer's lifetime is shorter than the `client` buffer's, this can cause a use after free. This could cause the server to crash or to return arbitrary memory contents to the client.\n\n`openssl` 0.10.70 fixes the signature of `ssl::select_next_proto` to properly constrain the output buffer's lifetime to that of both input buffers.\n\nIn standard usage of `ssl::select_next_proto` in the callback passed to `SslContextBuilder::set_alpn_select_callback`, code is only affected if the `server` buffer is constructed *within* the callback. For example:\n\nNot vulnerable - the server buffer has a `'static` lifetime:\n```rust\nbuilder.set_alpn_select_callback(|_, client_protos| {\n    ssl::select_next_proto(b\"\\x02h2\", client_protos).ok_or_else(AlpnError::NOACK)\n});\n```\n\nNot vulnerable - the server buffer outlives the handshake:\n```rust\nlet server_protos = b\"\\x02h2\".to_vec();\nbuilder.set_alpn_select_callback(|_, client_protos| {\n    ssl::select_next_proto(&server_protos, client_protos).ok_or_else(AlpnError::NOACK)\n});\n```\n\nVulnerable - the server buffer is freed when the callback returns:\n```rust\nbuilder.set_alpn_select_callback(|_, client_protos| {\n    let server_protos = b\"\\x02h2\".to_vec();\n    ssl::select_next_proto(&server_protos, client_protos).ok_or_else(AlpnError::NOACK)\n});\n```","state":0,"publishedAt":"2025-02-02T12:00:00+00:00","modifiedAt":"2026-10-12T18:00:12.4069162+00:00","affected":[{"ecosystem":"crates.io","name":"openssl","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"0.10.70"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://crates.io/crates/openssl","https://rustsec.org/advisories/RUSTSEC-2025-0004.html","https://github.com/sfackler/rust-openssl/pull/2360"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2025-0004","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2025-0004","identifiers":["RUSTSEC-2025-0004","CVE-2025-24898","GHSA-rpmj-rpgj-qmpm"]},"retained":false,"historicalAffected":[]}],"coverage":[]}