CVE-2026-41677: Rust Openssl Passwd Cb Missing Length Bounds Checkcve-2026-41677-rust-openssl-passwd-cb-missing-length-bounds-check
Password callback FFI trampoline forwards the user closure's returned `usize` length to OpenSSL as `c_int` without checking that it does not exceed the buffer `size` parameter that OpenSSL passed in. A user closure that returns a value larger than `size` (e.g. mistaking the length of an external secret for the number of bytes written) causes OpenSSL 1.1.x /
