Information Disclosure Vulnerability in rustls by rustls

CVE-2026-123612

What is CVE-2026-123612?

In rustls versions 0.23.44 and 0.23.45, an information disclosure vulnerability has been identified that allows sensitive application data buffered prior to the completion of the handshake to be inadvertently sent to a client-facing server. This occurs when the Encrypted Client Hello is rejected. Specifically, the start_traffic() function queues plaintext data from the ClientConnection::writer() before the required encryption alert is sent, potentially exposing data that was meant for the inner server.

References