A use-after-free vulnerability exists in rustls-ffi versions 0.12.0 through 0.15.6 where client connection constructors retain a reference to the caller's server_name buffer instead of copying it. If the caller frees or reuses this buffer after the constructor returns, TLS processing may read freed memory. This affects clients that do not keep the server_name buffer alive for the lifetime of the rustls_client_config. The issue is fixed in version 0.15.7 and later.