Threats tagged 'ghsa-jrx3-hh25-gg3m'

Rustls versions 0.23.44 and 0.23.45 have an information disclosure vulnerability where application data buffered before handshake completion can be sent to the client-facing server if Encrypted Client Hello (ECH) is rejected. This occurs because plaintext data is queued and sent prematurely, exposing data intended for an inner server to the authenticated public_name server.