Information Disclosure Vulnerability in Rustls by Rustls Development Team
CVE-2026-123609

4.1MEDIUM

Key Information:

Vendor

Rustls

Status
Rustls
Vendor
CVE Published:
8 November 2026

What is CVE-2026-123609?

Rustls, a widely used TLS library, is impacted by an information disclosure vulnerability affecting versions prior to 0.23.46 and the pre-release versions up to 0.24.0-dev.2. This flaw allows for the potential exposure of sensitive client session values, where debug formatting may inadvertently log Tls12ClientSessionValue or Tls13ClientSessionValue. As a consequence, malicious entities with access to these logs could retrieve TLS 1.2 master secrets or TLS 1.3 resumption pre-shared keys, posing a significant risk to data integrity and confidentiality. Users are advised to upgrade to the latest stable release to mitigate this vulnerability.

Affected Version(s)

rustls 0 < 0.23.46

rustls 0.24.0-dev.1 < 0.24.0-dev.2

rustls 0.23.46

References

https://github.com/rustls/rustls/security/advisories/GHSA...
vendor-advisory
https://www.vulncheck.com/advisories/rustls-before-0.23.4...
third-party-advisory

CVSS V4

Score:
4.1
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.