CVE-2026-123613 is a vulnerability in rustls versions from 0.23.13 up to but not including 0.23.45. It involves improper input validation where TLS 1.3 handshake messages are accepted at incorrect encryption levels following a key change in the same record. This flaw allows a peer or on-path attacker to send a plaintext EncryptedExtensions message alongside the ServerHello, which rustls mistakenly accepts as unencrypted.
An information disclosure vulnerability exists in rustls versions 0.23.44 and 0.23.45. When Encrypted Client Hello (ECH) is rejected, application data buffered before handshake completion is sent to the client-facing server instead of being properly isolated. This occurs because start_traffic() queues plaintext data before sending the ech_required alert, causing the authenticated public_name server to receive data intended for the inner server. The issue is fixed in rustls version 0.23.46.
CVE-2026-123611 is a key exchange downgrade vulnerability in rustls versions before 0.23.46. It allows network attackers to manipulate the per-server-name key-exchange group record via an unauthenticated ServerHello message. By responding with a ServerHello selecting the X25519 algorithm, attackers can cause subsequent ClientHello messages to use classical key shares, thereby losing post-quantum confidentiality.
CVE-2026-123610 is a medium-severity vulnerability in rustls versions before 0.23.46. It involves uncontrolled memory allocation in the optional Brotli certificate decompression feature. Malicious peers can exploit this by sending a specially crafted certificate that requests up to 1 GiB of memory before authentication, potentially causing clients or servers to abort if they cannot allocate the requested memory.
CVE-2026-123609 is an information disclosure vulnerability in rustls versions before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2. The flaw arises from derived Debug formatting of client session values, which can expose secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue risk leaking TLS 1.2 master secrets or TLS 1.3 resumption PSKs to anyone with access to the logs.
A vulnerability in rustls versions 0.23.44, 0.23.45, and certain 0.24.0-dev releases causes buffered application data to be sent to the server before the client sends the mandatory 'ech_required' alert when Encrypted Client Hello (ECH) is rejected. This violates RFC 9849 requirements that no application data be sent before the alert. The issue affects clients using EchMode::Enable that send application data before handshake completion and connect to servers rejecting their ECH config. The flaw was fixed in rustls 0.23.46 and 0.24.0-dev.2.
A vulnerability in rustls allows a network attacker to poison the client's per-server-name key-exchange record by sending an unauthenticated ServerHello selecting the X25519 group. This causes subsequent ClientHellos for that server name to carry only an X25519 share, potentially leading the handshake to complete with classical key exchange only, losing quantum-resistant confidentiality. No authentication bypass or key compromise occurs. The issue is fixed in rustls versions 0.23.46 and 0.24.0-dev.2.
A vulnerability in rustls versions prior to 0.23.46 and between 0.24.0-dev.1 and 0.24.0-dev.2 allows the TLS master secret or TLS 1.3 resumption PSK to be exposed when formatting a client session value with the Debug trait. This can lead to leakage of sensitive key material if a custom ClientSessionStore logs these debug outputs. Built-in diagnostics do not expose these secrets, and the session-store interface warns about the sensitivity of these values.
Rustls contains a vulnerability in its Brotli certificate decompression feature, which is disabled by default. The Brotli decoder accepts an input-specified history window size that can be up to 1 GiB, potentially causing large memory allocations. This can lead to denial of service via memory exhaustion if a malicious peer sends specially crafted Brotli-encoded certificates. Both clients and servers enabling Brotli decompression and client authentication are affected. The issue is fixed in rustls versions 0.23.46 and 0.24.0-dev.2.
CVE-2026-108266 is a critical origin validation error in the Privasys rustls library prior to version 0.8.1. The vulnerability involves RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS session. This flaw allows an attacker with access to an enclave TLS private key to relay a genuine quote onto another connection, causing a relying party to mistakenly accept an attacker-terminated connection as if it were from the attested enclave. The issue is fixed in Privasys rustls version 0.8.1.
Rustls versions 0.23.13 through 0.23.44 incorrectly accept TLS 1.3 handshake messages sent at the wrong encryption level when they follow a key-changing message in the same record. This violates RFC 8446 section 5.1, which requires handshake messages to align with record boundaries around key changes. While the handshake transcript remains authenticated, this flaw allows a peer to send handshake messages that should be encrypted in plaintext without rustls rejecting the connection.