PkgSeer

Vulnerability RUSTSEC-2026-0346

Medium Risk

5 hours ago

`Debug` impls for client session values expose TLS secrets

0.21.0 - 0.23.45

Summary

`Debug` impls for client session values expose TLS secrets

Details

The Debug implementations of Tls12ClientSessionValue and Tls13ClientSessionValue were derived, and so included the TLS 1.2 master secret or TLS 1.3 resumption PSK in their output.

Custom ClientSessionStore implementations that format these values with Debug (for example, when logging) could disclose these secrets to readers of the logs. This conflicts with rustls's key-material redaction policy.

Ordinary connection and built-in session cache Debug output is redacted and is not affected.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Buffered application data sent to outer server after ECH rejection

0.23.44 - 0.23.45 RUSTSEC-2026-0347

Brotli certificate decompression can allocate up to 1 GiB before authentication

0.23.9 - 0.23.45 RUSTSEC-2026-0348

Unauthenticated ServerHello can downgrade later connections to classical key exchange

0.1.0 - 0.23.45 RUSTSEC-2026-0349

Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries

0.23.13 - 0.23.44 GHSA-2mjx-qc3c-rqvc

TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries

0.23.13 - 0.23.44 RUSTSEC-2026-0285

View all vulnerabilities for these packages

Impacted packages

rustls

Timeline

Published

5 hours ago

Last Modified

3 hours ago