CVE-2026-42327: Openssl · `X509Ref::ocsp_responders` can produce a `&str` that is not valid UTF-8
Affects opensslSource GCVE Database
Not known to be exploited : upgrade to 0.10.79 soon.
Data as of 10 Nov 2026, 14:22 UTC
Rated High by Threat Radar's AI analysis · No CVSS score from NVD or the CNA
- Patch
- Available – fixed in 0.10.79
Exploitation evidence
Disclosed: evidence found.
CVE published 4 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 10 Nov 2026.
What to do
Upgrade openssl to 0.10.79.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.ioopensslpkg:cargo/opensslOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade OpenSSL to version 0.10.79 or later, where the issue is fixed by validating UTF-8 encoding of OCSP responder URLs and returning an error if invalid. This prevents unsafe dereferencing of invalid UTF-8 strings. No other mitigation is required as the fix addresses the root cause.
Description
The OpenSSL library's `X509Ref::ocsp_responders` method returns OCSP responder URLs as `OpensslString` values that dereference to Rust `&str` without validating UTF-8 encoding. Since OpenSSL does not require these IA5String values to be ASCII, certificates containing non-UTF-8 bytes in the OCSP access location can cause safe Rust code to hold invalid UTF-8 strings, resulting in undefined behavior. This issue affects versions from 0.9.7 up to but not including 0.10.79. The vulnerability was fixed in version 0.10.79 by adding UTF-8 validation and returning an error for invalid URLs.