Rustls ffi: Use-after-free of caller-owned server name in client connection constructors
Affects rustls-ffiSource GCVE Database
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in 0.15.7
Data as of 27 Oct 2026, 11:15 UTC
What to do
Upgrade rustls-ffi to 0.15.7.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.iorustls-ffipkg:cargo/rustls-ffiOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade rustls-ffi to version 0.15.7 or later, where the client connection constructors copy the server_name buffer, eliminating the use-after-free condition. No other mitigation is required.
Description
A use-after-free vulnerability exists in rustls-ffi versions 0.12.0 through 0.15.6 where client connection constructors retain a reference to the caller's server_name buffer instead of copying it. If the caller frees or reuses this buffer after the constructor returns, TLS processing may read freed memory. This affects clients that do not keep the server_name buffer alive for the lifetime of the rustls_client_config. The issue is fixed in version 0.15.7 and later.