https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-08T21:03:46.430086+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cleanstart-2026-qq62108 CLEANSTART-2026-QQ62108 — Security fix for GHSA-c8m5-c952-6cm4 applied in: rustup 1.28.2-r4 2026-11-08T21:03:46.432371+00:00

Affected: CleanStart: rustup

Security vulnerability affects the rustup package. This issue is resolved in later releases. See references for vulnerability details.

 https://db.gcve.eu/vuln/rustsec-2026-0346 RUSTSEC-2026-0346 — `Debug` impls for client session values expose TLS secrets 2026-11-08T21:03:46.432437+00:00

Affected: crates.io: rustls

The `Debug` implementations of `Tls12ClientSessionValue` and `Tls13ClientSessionValue` were derived, and so included the TLS 1.2 master secret or TLS 1.3 resumption PSK in their output.

Custom `ClientSessionStore` implementations that format these values with `Debug` (for example, when logging) could disclose these secrets to readers of the logs. This conflicts with rustls's [key-material redaction policy](https://github.com/rustls/rustls/blob/99f2358cae2954837dbb866faf6727de75489ab9/SECURITY.md#boundary-public-api).

Ordinary connection and built-in session cache `Debug` output is redacted and is not affected.