Most recent entries from all https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 00:33:52 +0000 CVE-2026-123613 — Rustls 0.23.13 before 0.23.45 TLS 1.3 Handshake Encryption Level Bypass https://db.gcve.eu/vuln/cve-2026-123613 <p><strong>Affected:</strong> rustls</p> <p>Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the same record, because Deframer::aligned does not enforce RFC 8446 record-boundary alignment. A peer or on-path attacker can pack a plaintext EncryptedExtensions with the ServerHello, which rustls accepts unencrypted.</p> <p><strong>Affected:</strong> rustls</p> <p>Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the same record, because Deframer::aligned does not enforce RFC 8446 record-boundary alignment. A peer or on-path attacker can pack a plaintext EncryptedExtensions with the ServerHello, which rustls accepts unencrypted.</p> https://db.gcve.eu/vuln/cve-2026-123613