Description
Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| rustls | rustls | < 0.23.46, 0.24.0-dev.1 – < 0.24.0-dev.2 | 0.23.46 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rust-rustls | No fix yet | — |
| Debian 13 | rust-rustls | No fix yet | — |
| Debian 12 | rust-rustls | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | rust-rustls | No fix yet | — |
| Ubuntu 26.04 LTS | rust-rustls | No fix yet | — |
| Ubuntu 24.04 LTS | rust-rustls | No fix yet | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | rust +3 | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | rustls | < 0.23.46 | 0.23.46 | GHSA-c8m5-c952-6cm4 |
| crates.io | rustls | >= 0.24.0-dev.1, < 0.24.0-dev.2 | 0.24.0-dev.2 | GHSA-c8m5-c952-6cm4 |
| crates.io | rustls | >= 0.21.0, < 0.23.46 | 0.23.46 | RUSTSEC-2026-0346 |
References
- GitHub Security Advisory (GHSA-c8m5-c952-6cm4) vendor-advisory
- VulnCheck Advisory: Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 Secret Exposure via Debug third-party-advisory