FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

rustls-ffi -- Read after free

Affected packages
rustls-ffi < 0.15.7

Details

VuXML ID 4538886a-d1d9-11f1-8135-8447094a420f
Discovery 2026-10-26
Entry 2026-10-27

The RusTLS project reports:

functions retained a reference to the caller's server_name buffer after returning, rather than copying it. The API documentation did not require the buffer to outlive the call and as a result if the caller freed or reused the buffer, later TLS processing read freed memory. [GHSA-rc3f-4j82-cmrg]

References

URL https://github.com/rustls/rustls-ffi/releases/tag/v0.15.7