GHSA-r6vc-97x9-63vv
Out-of-bounds read when decoding CKA_ALLOWED_MECHANISMS
cryptoki treated the CKA_ALLOWED_MECHANISMS ulValueLen byte count as a
CK_MECHANISM_TYPE element count. A valid nonempty attribute returned through
the safe Session::get_attributes API could cause construction of an
out-of-bounds slice and undefined behavior.
Possible consequences include a process crash or denial of service and potential disclosure of adjacent heap words. Upgrade to the fixed patch release for the cryptoki 0.10, 0.11, or 0.12 line.
What each source reports
OSVRUSTSEC-2026-0286No score
Out-of-bounds read when decoding CKA_ALLOWED_MECHANISMS
cryptoki treated the CKA_ALLOWED_MECHANISMS ulValueLen byte count as a
CK_MECHANISM_TYPE element count. A valid nonempty attribute returned through
the safe Session::get_attributes API could cause construction of an
out-of-bounds slice and undefined behavior.
Possible consequences include a process crash or denial of service and potential disclosure of adjacent heap words. Upgrade to the fixed patch release for the cryptoki 0.10, 0.11, or 0.12 line.
- Record
RUSTSEC-2026-0286- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cryptokicrates.io | 0.0.0-0 up to 0.10.1, 0.11.0 up to 0.11.1, 0.12.0 up to 0.12.1 | 0.10.10.11.10.12.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-r6vc-97x9-63vv is a vulnerability with no CVSS score yet in cryptoki, published September 16, 2026. No source lists public exploit code. Fixed in cryptoki 0.10.1.