DEBIAN-CVE-2026-123612

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-123612
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-123612.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-123612
Upstream
Published
2026-11-08T02:16:56Z
Modified
2026-11-08T10:00:15Z
Severity
  • 2.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
[none]
Details

rustls 0.23.44 and 0.23.45 contain an information disclosure vulnerability that sends application data buffered before the handshake completes to the client-facing server when Encrypted Client Hello is rejected. Because start_traffic() queues plaintext from ClientConnection::writer() before sending the ech_required alert, the authenticated public_name server receives data intended for the inner server.

References

Affected packages

Debian:12 / rust-rustls

Package

Name
rust-rustls
Purl
pkg:deb/debian/rust-rustls?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.20.8-4
0.20.8-4.1
0.20.8-4.2
0.21.5-1
0.21.5-2
0.21.5-3
0.21.5-4
0.21.5-5
0.21.6-1
0.21.6-2
0.21.6-3
0.21.6-4
0.21.7-1
0.21.8-1
0.21.8-2
0.21.8-3
0.21.8-3.1
0.21.9-1
0.21.10-1
0.21.12-1
0.21.12-2
0.21.12-3
0.21.12-4
0.21.12-5
0.21.12-6
0.21.12-7
0.21.12-8
0.21.12-9
0.23.16-1
0.23.20+ds-1
0.23.20+ds-2
0.23.20+ds-3
0.23.20+ds-4
0.23.20+ds-5
0.23.20+ds-6
0.23.20+ds-7
0.23.20+ds-8
0.23.20+ds-9
0.23.20+ds-10
0.23.25+ds-1
0.23.26+ds-1
0.23.31+ds-1
0.23.31+ds-2
0.23.31+ds-3
0.23.31+ds-4
0.23.31+ds-5
0.23.31+ds-6
0.23.31+ds-7
0.23.32+ds-1
0.23.32+ds-2
0.23.33+ds-1
0.23.33+ds-2
0.23.33+ds-3
0.23.33+ds-4
0.23.35+ds-1
0.23.36+ds-1
0.23.37+ds-1
0.23.37+ds-2
0.23.37+ds-3
0.23.38+ds-1
0.23.40+ds-1
0.23.41+ds-1
0.23.43+ds-1
0.23.45+ds-1
0.23.46+ds-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-123612.json"

Debian:13 / rust-rustls

Package

Name
rust-rustls
Purl
pkg:deb/debian/rust-rustls?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.23.26+ds-1
0.23.31+ds-1
0.23.31+ds-2
0.23.31+ds-3
0.23.31+ds-4
0.23.31+ds-5
0.23.31+ds-6
0.23.31+ds-7
0.23.32+ds-1
0.23.32+ds-2
0.23.33+ds-1
0.23.33+ds-2
0.23.33+ds-3
0.23.33+ds-4
0.23.35+ds-1
0.23.36+ds-1
0.23.37+ds-1
0.23.37+ds-2
0.23.37+ds-3
0.23.38+ds-1
0.23.40+ds-1
0.23.41+ds-1
0.23.43+ds-1
0.23.45+ds-1
0.23.46+ds-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-123612.json"

Debian:14 / rust-rustls

Package

Name
rust-rustls
Purl
pkg:deb/debian/rust-rustls?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.23.26+ds-1
0.23.31+ds-1
0.23.31+ds-2
0.23.31+ds-3
0.23.31+ds-4
0.23.31+ds-5
0.23.31+ds-6
0.23.31+ds-7
0.23.32+ds-1
0.23.32+ds-2
0.23.33+ds-1
0.23.33+ds-2
0.23.33+ds-3
0.23.33+ds-4
0.23.35+ds-1
0.23.36+ds-1
0.23.37+ds-1
0.23.37+ds-2
0.23.37+ds-3
0.23.38+ds-1
0.23.40+ds-1
0.23.41+ds-1
0.23.43+ds-1
0.23.45+ds-1
0.23.46+ds-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-123612.json"