The OpenSSL library's `X509Ref::ocsp_responders` method returns OCSP responder URLs as `OpensslString` values that dereference to Rust `&str` without validating UTF-8 encoding. Since OpenSSL does not require these IA5String values to be ASCII, certificates containing non-UTF-8 bytes in the OCSP access location can cause safe Rust code to hold invalid UTF-8 strings, resulting in undefined behavior. This issue affects versions from 0.9.7 up to but not including 0.10.79. The vulnerability was fixed in version 0.10.79 by adding UTF-8 validation and returning an error for invalid URLs.