Skip to main content
cve.nowby Sazabi
← crates.io
crates.ioPackage

rustls

7 known vulnerabilities (1 high, 4 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 1 high, 4 medium, 2 low
Registry
crates.io

Advisories 7

  • CVE-2026-123612Medium 4.6

    rustls 0.23.44 and 0.23.45 ECH Rejection Application Data Disclosure

    Affected: from 0.23.44, fixed in 0.23.46.

  • rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share

    Affected: fixed in 0.23.46; from 0.24.0-dev.1, fixed in 0.24.0-dev.2; fixed in 0.23.46.

  • Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs

    Affected: fixed in 0.23.46; from 0.24.0-dev.1, fixed in 0.24.0-dev.2; from 0.21.0, fixed in 0.23.46.

  • Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.

    Affected: fixed in 0.23.46; from 0.24.0-dev.1, fixed in 0.24.0-dev.2; from 0.23.9, fixed in 0.23.46.

  • Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries

    Affected: from 0.23.13, fixed in 0.23.45.

  • CVE-2024-11738Medium 5.3

    Rustls: rustls network-reachable panic in `acceptor::accept`

    Affected: from 0.23.13, fixed in 0.23.18; from 0.23.0, fixed in 0.23.0; from 0.23.13, fixed in 0.23.18.

  • Rustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client input

    Affected: fixed in 0.21.11; from 0.22.0, fixed in 0.22.4; from 0.23.0, fixed in 0.23.5; from 0.23.0, fixed in 0.23.5; from 0.22.0, fixed in 0.22.4; from 0.21.0, fixed in 0.21.11; versions 0.20.