Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-123613 (GCVE-0-2026-123613)

Vulnerability from nvd – Published: 2026-11-08 01:38 – Updated: 2026-11-10 17:56

Title

Rustls 0.23.13 before 0.23.45 TLS 1.3 Handshake Encryption Level Bypass

Summary

Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the same record, because Deframer::aligned does not enforce RFC 8446 record-boundary alignment. A peer or on-path attacker can pack a plaintext EncryptedExtensions with the ServerHello, which rustls accepts unencrypted.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-10 16:29 UTC

CWE

CWE-20 - Improper Input Validation

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/rustls/rustls/security/advisor…	vendor-advisory
https://github.com/rustls/rustls/commit/5046bdf8a…	patch
https://www.vulncheck.com/advisories/rustls-0.23.…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
rustls	rustls	Affected: 0.23.13 , < 0.23.45 (semver) Unaffected: 0.23.45 (semver) cpe:2.3:a:rustls_project:rustls::::::::

Date Public

2026-09-14 00:00

Credits

randombit

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123613",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T16:29:35.553397Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T17:56:44.483Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/rustls",
          "product": "rustls",
          "vendor": "rustls",
          "versions": [
            {
              "lessThan": "0.23.45",
              "status": "affected",
              "version": "0.23.13",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.23.45",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:rustls_project:rustls:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.23.45",
                  "versionStartIncluding": "0.23.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "randombit"
        }
      ],
      "datePublic": "2026-09-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the same record, because Deframer::aligned does not enforce RFC 8446 record-boundary alignment. A peer or on-path attacker can pack a plaintext EncryptedExtensions with the ServerHello, which rustls accepts unencrypted."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T01:38:37.574Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-2mjx-qc3c-rqvc)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/rustls/rustls/security/advisories/GHSA-2mjx-qc3c-rqvc"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/rustls/rustls/commit/5046bdf8a612b35a2c1a9e168054c1d5c65e7dd7"
        },
        {
          "name": "VulnCheck Advisory: Rustls 0.23.13 before 0.23.45 TLS 1.3 Handshake Encryption Level Bypass",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/rustls-0.23.13-before-0.23.45-tls-1.3-handshake-encryption-level-bypass"
        }
      ],
      "title": "Rustls 0.23.13 before 0.23.45 TLS 1.3 Handshake Encryption Level Bypass",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-123613",
    "datePublished": "2026-11-08T01:38:37.574Z",
    "dateReserved": "2026-11-06T01:02:39.794Z",
    "dateUpdated": "2026-11-10T17:56:44.483Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123612 (GCVE-0-2026-123612)

Vulnerability from nvd – Published: 2026-11-08 01:38 – Updated: 2026-11-12 13:40

Title

rustls 0.23.44 and 0.23.45 ECH Rejection Application Data Disclosure

Summary

rustls 0.23.44 and 0.23.45 contain an information disclosure vulnerability that sends application data buffered before the handshake completes to the client-facing server when Encrypted Client Hello is rejected. Because start_traffic() queues plaintext from ClientConnection::writer() before sending the ech_required alert, the authenticated public_name server receives data intended for the inner server.

Severity

4.6 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

2.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-12 13:38 UTC

CWE

CWE-696 - Incorrect Behavior Order

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/rustls/rustls/security/advisor…	vendor-advisory
https://www.vulncheck.com/advisories/rustls-0.23.…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
rustls	rustls	Affected: 0.23.44 , < 0.23.46 (semver) Unaffected: 0.23.46 (semver) cpe:2.3:a:rustls_project:rustls::::::::

Date Public

2026-10-14 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123612",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-12T13:38:50.344082Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-12T13:40:04.848Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/rustls",
          "product": "rustls",
          "vendor": "rustls",
          "versions": [
            {
              "lessThan": "0.23.46",
              "status": "affected",
              "version": "0.23.44",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.23.46",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:rustls_project:rustls:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.23.46",
                  "versionStartIncluding": "0.23.44",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "rustls 0.23.44 and 0.23.45 contain an information disclosure vulnerability that sends application data buffered before the handshake completes to the client-facing server when Encrypted Client Hello is rejected. Because start_traffic() queues plaintext from ClientConnection::writer() before sending the ech_required alert, the authenticated public_name server receives data intended for the inner server."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-696",
              "description": "Incorrect Behavior Order",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T01:38:36.873Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-vp88-798v-h67f)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/rustls/rustls/security/advisories/GHSA-vp88-798v-h67f"
        },
        {
          "name": "VulnCheck Advisory: rustls 0.23.44 and 0.23.45 ECH Rejection Application Data Disclosure",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/rustls-0.23.44-and-0.23.45-ech-rejection-application-data-disclosure"
        }
      ],
      "title": "rustls 0.23.44 and 0.23.45 ECH Rejection Application Data Disclosure",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-123612",
    "datePublished": "2026-11-08T01:38:36.873Z",
    "dateReserved": "2026-11-06T01:02:39.794Z",
    "dateUpdated": "2026-11-12T13:40:04.848Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123611 (GCVE-0-2026-123611)

Vulnerability from nvd – Published: 2026-11-08 01:38 – Updated: 2026-11-13 03:12

Title

rustls before 0.23.46 Key Exchange Downgrade via Unauthenticated ServerHello

Summary

rustls before 0.23.46 contains a key exchange downgrade vulnerability that allows network attackers to poison the per-server-name key-exchange group record via an unauthenticated ServerHello. Attackers can answer one connection with a ServerHello selecting X25519, causing later ClientHellos to send only classical shares and lose post-quantum confidentiality.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-13 03:12 UTC

CWE

CWE-757 - Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/rustls/rustls/security/advisor…	vendor-advisory
https://www.vulncheck.com/advisories/rustls-befor…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
rustls	rustls	Affected: 0 , < 0.23.46 (semver) Unaffected: 0.23.46 (semver) cpe:2.3:a:rustls_project:rustls::::::::

Date Public

2026-10-14 00:00

Credits

Adam010341

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123611",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T03:12:06.691082Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T03:12:15.876Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/rustls",
          "product": "rustls",
          "vendor": "rustls",
          "versions": [
            {
              "lessThan": "0.23.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.23.46",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:rustls_project:rustls:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.23.46",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Adam010341"
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "rustls before 0.23.46 contains a key exchange downgrade vulnerability that allows network attackers to poison the per-server-name key-exchange group record via an unauthenticated ServerHello. Attackers can answer one connection with a ServerHello selecting X25519, causing later ClientHellos to send only classical shares and lose post-quantum confidentiality."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-757",
              "description": "Selection of Less-Secure Algorithm During Negotiation (\u0027Algorithm Downgrade\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T01:38:36.176Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-w44r-93j7-qv28)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/rustls/rustls/security/advisories/GHSA-w44r-93j7-qv28"
        },
        {
          "name": "VulnCheck Advisory: rustls before 0.23.46 Key Exchange Downgrade via Unauthenticated ServerHello",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/rustls-before-0.23.46-key-exchange-downgrade-via-unauthenticated-serverhello"
        }
      ],
      "title": "rustls before 0.23.46 Key Exchange Downgrade via Unauthenticated ServerHello",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-123611",
    "datePublished": "2026-11-08T01:38:36.176Z",
    "dateReserved": "2026-11-06T01:02:39.794Z",
    "dateUpdated": "2026-11-13T03:12:15.876Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123610 (GCVE-0-2026-123610)

Vulnerability from nvd – Published: 2026-11-08 01:38 – Updated: 2026-11-09 13:52

Title

rustls before 0.23.46 Denial of Service via Brotli Certificate Decompression

Summary

rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a certificate with a five-byte Brotli header requesting up to 1 GiB before authentication, aborting Brotli-enabled clients or client-authenticating servers whose allocator cannot satisfy the request.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 13:51 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/rustls/rustls/security/advisor…	vendor-advisory
https://www.vulncheck.com/advisories/rustls-befor…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
rustls	rustls	Affected: 0 , < 0.23.46 (semver) Unaffected: 0.23.46 (semver) cpe:2.3:a:rustls_project:rustls::::::::

Date Public

2026-10-14 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123610",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T13:51:53.595376Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T13:52:03.160Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/rustls",
          "product": "rustls",
          "vendor": "rustls",
          "versions": [
            {
              "lessThan": "0.23.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.23.46",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:rustls_project:rustls:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.23.46",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a certificate with a five-byte Brotli header requesting up to 1 GiB before authentication, aborting Brotli-enabled clients or client-authenticating servers whose allocator cannot satisfy the request."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T01:38:35.478Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-h2v8-394m-p7vv)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/rustls/rustls/security/advisories/GHSA-h2v8-394m-p7vv"
        },
        {
          "name": "VulnCheck Advisory: rustls before 0.23.46 Denial of Service via Brotli Certificate Decompression",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/rustls-before-0.23.46-denial-of-service-via-brotli-certificate-decompression"
        }
      ],
      "title": "rustls before 0.23.46 Denial of Service via Brotli Certificate Decompression",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-123610",
    "datePublished": "2026-11-08T01:38:35.478Z",
    "dateReserved": "2026-11-06T01:02:39.794Z",
    "dateUpdated": "2026-11-09T13:52:03.160Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123609 (GCVE-0-2026-123609)

Vulnerability from nvd – Published: 2026-11-08 01:38 – Updated: 2026-11-10 17:56

Title

Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 Secret Exposure via Debug

Summary

Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.

Severity

4.1 (Medium)


                        
                          CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-10 15:42 UTC

CWE

CWE-212 - Improper Removal of Sensitive Information Before Storage or Transfer

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/rustls/rustls/security/advisor…	vendor-advisory
https://www.vulncheck.com/advisories/rustls-befor…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
rustls	rustls	Affected: 0 , < 0.23.46 (semver) Unaffected: 0.23.46 (semver) Affected: 0.24.0-dev.1 , < 0.24.0-dev.2 (semver) Unaffected: 0.24.0-dev.2 (semver) cpe:2.3:a:rustls_project:rustls:::::::: cpe:2.3:a:rustls_project:rustls::::::::

Date Public

2026-10-14 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123609",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T15:42:07.621483Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T17:56:51.627Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/rustls",
          "product": "rustls",
          "vendor": "rustls",
          "versions": [
            {
              "lessThan": "0.23.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.23.46",
              "versionType": "semver"
            },
            {
              "lessThan": "0.24.0-dev.2",
              "status": "affected",
              "version": "0.24.0-dev.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.24.0-dev.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:rustls_project:rustls:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.23.46",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:rustls_project:rustls:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.24.0-dev.2",
                  "versionStartIncluding": "0.24.0-dev.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-212",
              "description": "Improper Removal of Sensitive Information Before Storage or Transfer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T01:38:34.811Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-c8m5-c952-6cm4)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/rustls/rustls/security/advisories/GHSA-c8m5-c952-6cm4"
        },
        {
          "name": "VulnCheck Advisory: Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 Secret Exposure via Debug",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/rustls-before-0.23.46-and-0.24.0-dev.1-before-0.24.0-dev.2-secret-exposure-via-debug"
        }
      ],
      "title": "Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 Secret Exposure via Debug",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-123609",
    "datePublished": "2026-11-08T01:38:34.811Z",
    "dateReserved": "2026-11-06T01:02:39.794Z",
    "dateUpdated": "2026-11-10T17:56:51.627Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-32650 (GCVE-0-2024-32650)

Vulnerability from nvd – Published: 2024-04-19 16:05 – Updated: 2024-08-02 02:13

Title

Rustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client input

Summary

Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-04-22 15:34 UTC

CWE

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7868 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/rustls/rustls/security/advisor…	x_refsource_CONFIRM
https://github.com/rustls/rustls/commit/212357684…	x_refsource_MISC
https://github.com/rustls/rustls/commit/6e938bcfe…	x_refsource_MISC
https://github.com/rustls/rustls/commit/f45664fbd…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
rustls	rustls	Affected: >= 0.23.0, < 0.23.5 Affected: >= 0.22.0, < 0.22.4 Affected: >= 0.21.0, < 0.21.11 Affected: = 0.20.0
rustls_project	rustls	Unknown: 0.21.11 cpe:2.3:a:rustls_project:rustls::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:rustls_project:rustls:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "rustls",
            "vendor": "rustls_project",
            "versions": [
              {
                "status": "unknown",
                "version": "0.21.11"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-32650",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-22T15:34:25.994212Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:49:50.274Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:13:40.195Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj"
          },
          {
            "name": "https://github.com/rustls/rustls/commit/2123576840aa31043a31b0770e6572136fbe0c2d",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rustls/rustls/commit/2123576840aa31043a31b0770e6572136fbe0c2d"
          },
          {
            "name": "https://github.com/rustls/rustls/commit/6e938bcfe82a9da7a2e1cbf10b928c7eca26426e",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rustls/rustls/commit/6e938bcfe82a9da7a2e1cbf10b928c7eca26426e"
          },
          {
            "name": "https://github.com/rustls/rustls/commit/f45664fbded03d833dffd806503d3c8becd1b71e",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rustls/rustls/commit/f45664fbded03d833dffd806503d3c8becd1b71e"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "rustls",
          "vendor": "rustls",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.23.0, \u003c 0.23.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.22.0, \u003c 0.22.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.21.0, \u003c 0.21.11"
            },
            {
              "status": "affected",
              "version": "= 0.20.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server\u0027s `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-19T19:47:45.579Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj"
        },
        {
          "name": "https://github.com/rustls/rustls/commit/2123576840aa31043a31b0770e6572136fbe0c2d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rustls/rustls/commit/2123576840aa31043a31b0770e6572136fbe0c2d"
        },
        {
          "name": "https://github.com/rustls/rustls/commit/6e938bcfe82a9da7a2e1cbf10b928c7eca26426e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rustls/rustls/commit/6e938bcfe82a9da7a2e1cbf10b928c7eca26426e"
        },
        {
          "name": "https://github.com/rustls/rustls/commit/f45664fbded03d833dffd806503d3c8becd1b71e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rustls/rustls/commit/f45664fbded03d833dffd806503d3c8becd1b71e"
        }
      ],
      "source": {
        "advisory": "GHSA-6g7w-8wpp-frhj",
        "discovery": "UNKNOWN"
      },
      "title": "Rustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client input"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-32650",
    "datePublished": "2024-04-19T16:05:44.050Z",
    "dateReserved": "2024-04-16T14:15:26.876Z",
    "dateUpdated": "2024-08-02T02:13:40.195Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-123613 (GCVE-0-2026-123613)

Vulnerability from cvelistv5 – Published: 2026-11-08 01:38 – Updated: 2026-11-10 17:56

Title

Rustls 0.23.13 before 0.23.45 TLS 1.3 Handshake Encryption Level Bypass

Summary

Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the same record, because Deframer::aligned does not enforce RFC 8446 record-boundary alignment. A peer or on-path attacker can pack a plaintext EncryptedExtensions with the ServerHello, which rustls accepts unencrypted.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-10 16:29 UTC

CWE

CWE-20 - Improper Input Validation

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/rustls/rustls/security/advisor…	vendor-advisory
https://github.com/rustls/rustls/commit/5046bdf8a…	patch
https://www.vulncheck.com/advisories/rustls-0.23.…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
rustls	rustls	Affected: 0.23.13 , < 0.23.45 (semver) Unaffected: 0.23.45 (semver) cpe:2.3:a:rustls_project:rustls::::::::

Date Public

2026-09-14 00:00

Credits

randombit

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123613",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T16:29:35.553397Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T17:56:44.483Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/rustls",
          "product": "rustls",
          "vendor": "rustls",
          "versions": [
            {
              "lessThan": "0.23.45",
              "status": "affected",
              "version": "0.23.13",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.23.45",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:rustls_project:rustls:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.23.45",
                  "versionStartIncluding": "0.23.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "randombit"
        }
      ],
      "datePublic": "2026-09-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the same record, because Deframer::aligned does not enforce RFC 8446 record-boundary alignment. A peer or on-path attacker can pack a plaintext EncryptedExtensions with the ServerHello, which rustls accepts unencrypted."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T01:38:37.574Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-2mjx-qc3c-rqvc)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/rustls/rustls/security/advisories/GHSA-2mjx-qc3c-rqvc"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/rustls/rustls/commit/5046bdf8a612b35a2c1a9e168054c1d5c65e7dd7"
        },
        {
          "name": "VulnCheck Advisory: Rustls 0.23.13 before 0.23.45 TLS 1.3 Handshake Encryption Level Bypass",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/rustls-0.23.13-before-0.23.45-tls-1.3-handshake-encryption-level-bypass"
        }
      ],
      "title": "Rustls 0.23.13 before 0.23.45 TLS 1.3 Handshake Encryption Level Bypass",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-123613",
    "datePublished": "2026-11-08T01:38:37.574Z",
    "dateReserved": "2026-11-06T01:02:39.794Z",
    "dateUpdated": "2026-11-10T17:56:44.483Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123612 (GCVE-0-2026-123612)

Vulnerability from cvelistv5 – Published: 2026-11-08 01:38 – Updated: 2026-11-12 13:40

Title

rustls 0.23.44 and 0.23.45 ECH Rejection Application Data Disclosure

Summary

rustls 0.23.44 and 0.23.45 contain an information disclosure vulnerability that sends application data buffered before the handshake completes to the client-facing server when Encrypted Client Hello is rejected. Because start_traffic() queues plaintext from ClientConnection::writer() before sending the ech_required alert, the authenticated public_name server receives data intended for the inner server.

Severity

4.6 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

2.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-12 13:38 UTC

CWE

CWE-696 - Incorrect Behavior Order

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/rustls/rustls/security/advisor…	vendor-advisory
https://www.vulncheck.com/advisories/rustls-0.23.…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
rustls	rustls	Affected: 0.23.44 , < 0.23.46 (semver) Unaffected: 0.23.46 (semver) cpe:2.3:a:rustls_project:rustls::::::::

Date Public

2026-10-14 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123612",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-12T13:38:50.344082Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-12T13:40:04.848Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/rustls",
          "product": "rustls",
          "vendor": "rustls",
          "versions": [
            {
              "lessThan": "0.23.46",
              "status": "affected",
              "version": "0.23.44",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.23.46",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:rustls_project:rustls:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.23.46",
                  "versionStartIncluding": "0.23.44",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "rustls 0.23.44 and 0.23.45 contain an information disclosure vulnerability that sends application data buffered before the handshake completes to the client-facing server when Encrypted Client Hello is rejected. Because start_traffic() queues plaintext from ClientConnection::writer() before sending the ech_required alert, the authenticated public_name server receives data intended for the inner server."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-696",
              "description": "Incorrect Behavior Order",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T01:38:36.873Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-vp88-798v-h67f)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/rustls/rustls/security/advisories/GHSA-vp88-798v-h67f"
        },
        {
          "name": "VulnCheck Advisory: rustls 0.23.44 and 0.23.45 ECH Rejection Application Data Disclosure",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/rustls-0.23.44-and-0.23.45-ech-rejection-application-data-disclosure"
        }
      ],
      "title": "rustls 0.23.44 and 0.23.45 ECH Rejection Application Data Disclosure",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-123612",
    "datePublished": "2026-11-08T01:38:36.873Z",
    "dateReserved": "2026-11-06T01:02:39.794Z",
    "dateUpdated": "2026-11-12T13:40:04.848Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123611 (GCVE-0-2026-123611)

Vulnerability from cvelistv5 – Published: 2026-11-08 01:38 – Updated: 2026-11-13 03:12

Title

rustls before 0.23.46 Key Exchange Downgrade via Unauthenticated ServerHello

Summary

rustls before 0.23.46 contains a key exchange downgrade vulnerability that allows network attackers to poison the per-server-name key-exchange group record via an unauthenticated ServerHello. Attackers can answer one connection with a ServerHello selecting X25519, causing later ClientHellos to send only classical shares and lose post-quantum confidentiality.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-13 03:12 UTC

CWE

CWE-757 - Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/rustls/rustls/security/advisor…	vendor-advisory
https://www.vulncheck.com/advisories/rustls-befor…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
rustls	rustls	Affected: 0 , < 0.23.46 (semver) Unaffected: 0.23.46 (semver) cpe:2.3:a:rustls_project:rustls::::::::

Date Public

2026-10-14 00:00

Credits

Adam010341

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123611",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T03:12:06.691082Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T03:12:15.876Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/rustls",
          "product": "rustls",
          "vendor": "rustls",
          "versions": [
            {
              "lessThan": "0.23.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.23.46",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:rustls_project:rustls:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.23.46",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Adam010341"
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "rustls before 0.23.46 contains a key exchange downgrade vulnerability that allows network attackers to poison the per-server-name key-exchange group record via an unauthenticated ServerHello. Attackers can answer one connection with a ServerHello selecting X25519, causing later ClientHellos to send only classical shares and lose post-quantum confidentiality."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-757",
              "description": "Selection of Less-Secure Algorithm During Negotiation (\u0027Algorithm Downgrade\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T01:38:36.176Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-w44r-93j7-qv28)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/rustls/rustls/security/advisories/GHSA-w44r-93j7-qv28"
        },
        {
          "name": "VulnCheck Advisory: rustls before 0.23.46 Key Exchange Downgrade via Unauthenticated ServerHello",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/rustls-before-0.23.46-key-exchange-downgrade-via-unauthenticated-serverhello"
        }
      ],
      "title": "rustls before 0.23.46 Key Exchange Downgrade via Unauthenticated ServerHello",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-123611",
    "datePublished": "2026-11-08T01:38:36.176Z",
    "dateReserved": "2026-11-06T01:02:39.794Z",
    "dateUpdated": "2026-11-13T03:12:15.876Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123610 (GCVE-0-2026-123610)

Vulnerability from cvelistv5 – Published: 2026-11-08 01:38 – Updated: 2026-11-09 13:52

Title

rustls before 0.23.46 Denial of Service via Brotli Certificate Decompression

Summary

rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a certificate with a five-byte Brotli header requesting up to 1 GiB before authentication, aborting Brotli-enabled clients or client-authenticating servers whose allocator cannot satisfy the request.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 13:51 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/rustls/rustls/security/advisor…	vendor-advisory
https://www.vulncheck.com/advisories/rustls-befor…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
rustls	rustls	Affected: 0 , < 0.23.46 (semver) Unaffected: 0.23.46 (semver) cpe:2.3:a:rustls_project:rustls::::::::

Date Public

2026-10-14 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123610",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T13:51:53.595376Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T13:52:03.160Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/rustls",
          "product": "rustls",
          "vendor": "rustls",
          "versions": [
            {
              "lessThan": "0.23.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.23.46",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:rustls_project:rustls:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.23.46",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a certificate with a five-byte Brotli header requesting up to 1 GiB before authentication, aborting Brotli-enabled clients or client-authenticating servers whose allocator cannot satisfy the request."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T01:38:35.478Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-h2v8-394m-p7vv)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/rustls/rustls/security/advisories/GHSA-h2v8-394m-p7vv"
        },
        {
          "name": "VulnCheck Advisory: rustls before 0.23.46 Denial of Service via Brotli Certificate Decompression",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/rustls-before-0.23.46-denial-of-service-via-brotli-certificate-decompression"
        }
      ],
      "title": "rustls before 0.23.46 Denial of Service via Brotli Certificate Decompression",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-123610",
    "datePublished": "2026-11-08T01:38:35.478Z",
    "dateReserved": "2026-11-06T01:02:39.794Z",
    "dateUpdated": "2026-11-09T13:52:03.160Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123609 (GCVE-0-2026-123609)

Vulnerability from cvelistv5 – Published: 2026-11-08 01:38 – Updated: 2026-11-10 17:56

Title

Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 Secret Exposure via Debug

Summary

Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.

Severity

4.1 (Medium)


                        
                          CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-10 15:42 UTC

CWE

CWE-212 - Improper Removal of Sensitive Information Before Storage or Transfer

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/rustls/rustls/security/advisor…	vendor-advisory
https://www.vulncheck.com/advisories/rustls-befor…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
rustls	rustls	Affected: 0 , < 0.23.46 (semver) Unaffected: 0.23.46 (semver) Affected: 0.24.0-dev.1 , < 0.24.0-dev.2 (semver) Unaffected: 0.24.0-dev.2 (semver) cpe:2.3:a:rustls_project:rustls:::::::: cpe:2.3:a:rustls_project:rustls::::::::

Date Public

2026-10-14 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123609",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T15:42:07.621483Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T17:56:51.627Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/rustls",
          "product": "rustls",
          "vendor": "rustls",
          "versions": [
            {
              "lessThan": "0.23.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.23.46",
              "versionType": "semver"
            },
            {
              "lessThan": "0.24.0-dev.2",
              "status": "affected",
              "version": "0.24.0-dev.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.24.0-dev.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:rustls_project:rustls:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.23.46",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:rustls_project:rustls:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.24.0-dev.2",
                  "versionStartIncluding": "0.24.0-dev.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-212",
              "description": "Improper Removal of Sensitive Information Before Storage or Transfer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T01:38:34.811Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-c8m5-c952-6cm4)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/rustls/rustls/security/advisories/GHSA-c8m5-c952-6cm4"
        },
        {
          "name": "VulnCheck Advisory: Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 Secret Exposure via Debug",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/rustls-before-0.23.46-and-0.24.0-dev.1-before-0.24.0-dev.2-secret-exposure-via-debug"
        }
      ],
      "title": "Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 Secret Exposure via Debug",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-123609",
    "datePublished": "2026-11-08T01:38:34.811Z",
    "dateReserved": "2026-11-06T01:02:39.794Z",
    "dateUpdated": "2026-11-10T17:56:51.627Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-32650 (GCVE-0-2024-32650)

Vulnerability from cvelistv5 – Published: 2024-04-19 16:05 – Updated: 2024-08-02 02:13

Title

Rustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client input

Summary

Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-04-22 15:34 UTC

CWE

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7868 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/rustls/rustls/security/advisor…	x_refsource_CONFIRM
https://github.com/rustls/rustls/commit/212357684…	x_refsource_MISC
https://github.com/rustls/rustls/commit/6e938bcfe…	x_refsource_MISC
https://github.com/rustls/rustls/commit/f45664fbd…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
rustls	rustls	Affected: >= 0.23.0, < 0.23.5 Affected: >= 0.22.0, < 0.22.4 Affected: >= 0.21.0, < 0.21.11 Affected: = 0.20.0
rustls_project	rustls	Unknown: 0.21.11 cpe:2.3:a:rustls_project:rustls::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:rustls_project:rustls:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "rustls",
            "vendor": "rustls_project",
            "versions": [
              {
                "status": "unknown",
                "version": "0.21.11"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-32650",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-22T15:34:25.994212Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:49:50.274Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:13:40.195Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj"
          },
          {
            "name": "https://github.com/rustls/rustls/commit/2123576840aa31043a31b0770e6572136fbe0c2d",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rustls/rustls/commit/2123576840aa31043a31b0770e6572136fbe0c2d"
          },
          {
            "name": "https://github.com/rustls/rustls/commit/6e938bcfe82a9da7a2e1cbf10b928c7eca26426e",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rustls/rustls/commit/6e938bcfe82a9da7a2e1cbf10b928c7eca26426e"
          },
          {
            "name": "https://github.com/rustls/rustls/commit/f45664fbded03d833dffd806503d3c8becd1b71e",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rustls/rustls/commit/f45664fbded03d833dffd806503d3c8becd1b71e"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "rustls",
          "vendor": "rustls",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.23.0, \u003c 0.23.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.22.0, \u003c 0.22.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.21.0, \u003c 0.21.11"
            },
            {
              "status": "affected",
              "version": "= 0.20.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server\u0027s `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-19T19:47:45.579Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj"
        },
        {
          "name": "https://github.com/rustls/rustls/commit/2123576840aa31043a31b0770e6572136fbe0c2d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rustls/rustls/commit/2123576840aa31043a31b0770e6572136fbe0c2d"
        },
        {
          "name": "https://github.com/rustls/rustls/commit/6e938bcfe82a9da7a2e1cbf10b928c7eca26426e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rustls/rustls/commit/6e938bcfe82a9da7a2e1cbf10b928c7eca26426e"
        },
        {
          "name": "https://github.com/rustls/rustls/commit/f45664fbded03d833dffd806503d3c8becd1b71e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rustls/rustls/commit/f45664fbded03d833dffd806503d3c8becd1b71e"
        }
      ],
      "source": {
        "advisory": "GHSA-6g7w-8wpp-frhj",
        "discovery": "UNKNOWN"
      },
      "title": "Rustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client input"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-32650",
    "datePublished": "2024-04-19T16:05:44.050Z",
    "dateReserved": "2024-04-16T14:15:26.876Z",
    "dateUpdated": "2024-08-02T02:13:40.195Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria

12 vulnerabilities found for rustls by rustls

CVE-2026-123613 (GCVE-0-2026-123613)

CVE-2026-123612 (GCVE-0-2026-123612)

CVE-2026-123611 (GCVE-0-2026-123611)

CVE-2026-123610 (GCVE-0-2026-123610)

CVE-2026-123609 (GCVE-0-2026-123609)

CVE-2024-32650 (GCVE-0-2024-32650)

CVE-2026-123613 (GCVE-0-2026-123613)

CVE-2026-123612 (GCVE-0-2026-123612)

CVE-2026-123611 (GCVE-0-2026-123611)

CVE-2026-123610 (GCVE-0-2026-123610)

CVE-2026-123609 (GCVE-0-2026-123609)

CVE-2024-32650 (GCVE-0-2024-32650)