Skip to content
OpenAdvisories

Package · Ubuntu

rust-rustls

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-123613

    Rustls 0.23.13 before 0.23.45 TLS 1.3 Handshake Encryption Level Bypass

    Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the same record, because Deframer::aligned does not enforce RFC 8446 record-boundary alignment. A peer or on-path at…

    rustls rustls rustls rust-rustls Debian Ubuntu crates.io
  • Medium 4.0
    CVE-2026-123609

    Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 Secret Exposure via Debug

    Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSess…

    rustls rustls rustls rust-rustls Debian Ubuntu crates.io
  • Medium 5.3
    CVE-2024-11738

    Rustls: rustls network-reachable panic in `acceptor::accept`

    A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.

    Red Hat Red Hat Trusted Artifact Signer rustls rust-rustls Ubuntu crates.io