—
RUSTSEC-2026-0286
Out-of-bounds read when decoding CKA_ALLOWED_MECHANISMS
Details
`cryptoki` treated the CKA_ALLOWED_MECHANISMS ulValueLen byte count as a CK_MECHANISM_TYPE element count. A valid nonempty attribute returned through the safe `Session::get_attributes` API could cause construction of an out-of-bounds slice and undefined behavior.
Possible consequences include a process crash or denial of service and potential disclosure of adjacent heap words. Upgrade to the fixed patch release for the cryptoki 0.10, 0.11, or 0.12 line.
Are you affected?
Enter the version of the package you're using.
Affected packages
crates.io/cryptoki
Introduced in:
0.0.0-0Fixed in: 0.10.1Upgrade cryptoki to 0.10.1 or newer (ecosystem crates.io).