RUSTSEC-2026-0346

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0346

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0346.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0346

Aliases

GHSA-c8m5-c952-6cm4

Published

2026-10-14T12:00:00Z

Modified

2026-10-14T13:30:02Z

Severity

4.0 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N CVSS Calculator

Summary

`Debug` impls for client session values expose TLS secrets

Details

The Debug implementations of Tls12ClientSessionValue and Tls13ClientSessionValue were derived, and so included the TLS 1.2 master secret or TLS 1.3 resumption PSK in their output.

Custom ClientSessionStore implementations that format these values with Debug (for example, when logging) could disclose these secrets to readers of the logs. This conflicts with rustls's key-material redaction policy.

Ordinary connection and built-in session cache Debug output is redacted and is not affected.

Database specific

{
    "license":  "CC0-1.0"
}

References

Affected packages

crates.io / rustls

Package

Name: rustls; View open source insights on deps.dev
Purl: pkg:cargo/rustls

Affected ranges

Type: SEMVER
Events: Introduced

0.21.0

Fixed

0.23.46

Ecosystem specific

{
    "affected_functions":  null,
    "affects":  {
        "arch":  [],
        "functions":  [],
        "os":  []
    }
}