Debian Rust Security Tracker 🩺🦀

RUSTSEC-2026-0286: Out-of-bounds read when decoding CKA_ALLOWED_MECHANISMS

1 affected
Crate
cryptoki
Patched Versions
>=0.10.1, <0.11.0
>=0.11.1, <0.12.0
>=0.12.1
Debian Version
0.12.1-1
Debian Bugs
—
Issued
2026-09-16
Aliases
GHSA-r6vc-97x9-63vv
Patched:Affected

cryptoki treated the CKA_ALLOWED_MECHANISMS ulValueLen byte count as a CK_MECHANISM_TYPE element count. A valid nonempty attribute returned through the safe Session::get_attributes API could cause construction of an out-of-bounds slice and undefined behavior.

Possible consequences include a process crash or denial of service and potential disclosure of adjacent heap words. Upgrade to the fixed patch release for the cryptoki 0.10, 0.11, or 0.12 line.

Affected Packages

cryptoki 0.12.0 parsec-service 1.5.0+ds-1