{"answers":{"affected":"1 open source package ship an affected version, including cryptoki.","exploited":"There is no known exploitation of RUSTSEC-2026-0286 in the wild and no public exploit code.","fix":"Upgrade cryptoki to a fixed version for your release line: 0.10.1, 0.11.1 or 0.12.1.","what":"RUSTSEC-2026-0286 is a memory corruption vulnerability in cryptoki, published on 16 Sep 2026."},"fix_prompt":"Check this codebase for RUSTSEC-2026-0286 and fix it if it is affected.\n\nWhat it is: RUSTSEC-2026-0286 is a memory corruption vulnerability in cryptoki, published on 16 Sep 2026. \nExploitation: There is no known exploitation of RUSTSEC-2026-0286 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- cryptoki (crates.io): affected from 0.0.0-0; fixed in 0.10.1, 0.11.1, 0.12.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/RUSTSEC-2026-0286/ (Markdown: https://insights.sbomify.com/RUSTSEC-2026-0286/index.md)","id":"RUSTSEC-2026-0286","markdown":"https://insights.sbomify.com/RUSTSEC-2026-0286/index.md","name":"RUSTSEC-2026-0286","record":{"aliases":["GHSA-r6vc-97x9-63vv"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service","data_read"],"network_reachable":"unknown","non_default_config":false,"product_category":"Rust PKCS#11 library","requires_auth":"none","summary":"An out-of-bounds read in the cryptoki library allows attackers to cause crashes or disclose heap memory via crafted PKCS#11 attributes.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"`cryptoki` treated the CKA_ALLOWED_MECHANISMS ulValueLen byte count as a\nCK_MECHANISM_TYPE element count. A valid nonempty attribute returned through\nthe safe `Session::get_attributes` API could cause construction of an\nout-of-bounds slice and undefined behavior.\n\nPossible consequences include a process crash or denial of service and\npotential disclosure of adjacent heap words. Upgrade to the fixed patch release\nfor the cryptoki 0.10, 0.11, or 0.12 line.","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Out-of-bounds read when decoding CKA_ALLOWED_MECHANISMS","id":"RUSTSEC-2026-0286","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"memory_corruption","year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["0.10.1","0.11.1","0.12.1"],"introduced":["0.0.0-0","0.11.0","0.12.0"],"last_affected":[],"package":"cryptoki","purl":"pkg:cargo/cryptoki","source":"RUSTSEC-2026-0286"}],"products":null,"published":"2026-09-16","related":[],"sources":[{"class":"open","licence":"CC0 1.0","name":"RustSec","prefix":"RUSTSEC"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"An out-of-bounds read in the cryptoki library allows attackers to cause crashes or disclose heap memory via crafted PKCS#11 attributes.","url":"https://insights.sbomify.com/RUSTSEC-2026-0286/"}