RUSTSEC-2026-0286 Out-of-bounds read when decoding CKA_ALLOWED_MECHANISMS
An out-of-bounds read in the cryptoki library allows attackers to cause crashes or disclose heap memory via crafted PKCS#11 attributes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is RUSTSEC-2026-0286?
RUSTSEC-2026-0286 is a memory corruption vulnerability in cryptoki, published on 16 Sep 2026.
Official description
cryptoki treated the CKA_ALLOWED_MECHANISMS ulValueLen byte count as a
CK_MECHANISM_TYPE element count. A valid nonempty attribute returned through
the safe Session::get_attributes API could cause construction of an
out-of-bounds slice and undefined behavior.
Possible consequences include a process crash or denial of service and potential disclosure of adjacent heap words. Upgrade to the fixed patch release for the cryptoki 0.10, 0.11, or 0.12 line.
Which versions are affected by RUSTSEC-2026-0286?
1 open source package ship an affected version, including cryptoki.
| Package | Affected | Fixed in |
|---|---|---|
cryptoki crates.io | From 0.0.0-0 | 0.10.1, 0.11.1, 0.12.1 |
How do I fix RUSTSEC-2026-0286?
Upgrade cryptoki to a fixed version for your release line: 0.10.1, 0.11.1 or 0.12.1.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is RUSTSEC-2026-0286 being exploited?
There is no known exploitation of RUSTSEC-2026-0286 in the wild and no public exploit code.
Sources
Also known as GHSA-r6vc-97x9-63vv.