# rustls (crates.io) vulnerabilities

7 known vulnerabilities (1 high, 4 medium, 2 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://crates.io/crates/rustls

## Advisories (7)

### [CVE-2026-123612](https://cve.now/CVE-2026-123612): rustls 0.23.44 and 0.23.45 ECH Rejection Application Data Disclosure

- Severity: Medium 4.6
- Published: Nov 8, 2026
- Affected: from 0.23.44, fixed in 0.23.46.

### [GHSA-W44R-93J7-QV28](https://cve.now/GHSA-W44R-93J7-QV28): rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share

- Severity: Low
- Published: Oct 27, 2026
- Affected: fixed in 0.23.46; from 0.24.0-dev.1, fixed in 0.24.0-dev.2; fixed in 0.23.46.

### [GHSA-C8M5-C952-6CM4](https://cve.now/GHSA-C8M5-C952-6CM4): Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs

- Severity: Medium
- Published: Oct 27, 2026
- Affected: fixed in 0.23.46; from 0.24.0-dev.1, fixed in 0.24.0-dev.2; from 0.21.0, fixed in 0.23.46.

### [GHSA-H2V8-394M-P7VV](https://cve.now/GHSA-H2V8-394M-P7VV): Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.

- Severity: Low
- Published: Oct 27, 2026
- Affected: fixed in 0.23.46; from 0.24.0-dev.1, fixed in 0.24.0-dev.2; from 0.23.9, fixed in 0.23.46.

### [GHSA-2MJX-QC3C-RQVC](https://cve.now/GHSA-2MJX-QC3C-RQVC): Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries

- Severity: Medium
- Published: Oct 5, 2026
- Affected: from 0.23.13, fixed in 0.23.45.

### [CVE-2024-11738](https://cve.now/CVE-2024-11738): Rustls: rustls network-reachable panic in \`acceptor::accept\`

- Severity: Medium 5.3
- Published: Dec 6, 2024
- Affected: from 0.23.13, fixed in 0.23.18; from 0.23.0, fixed in 0.23.0; from 0.23.13, fixed in 0.23.18.

### [CVE-2024-32650](https://cve.now/CVE-2024-32650): Rustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete\_io() with proper client input

- Severity: High 7.5
- Published: Apr 19, 2024
- Affected: fixed in 0.21.11; from 0.22.0, fixed in 0.22.4; from 0.23.0, fixed in 0.23.5; from 0.23.0, fixed in 0.23.5; from 0.22.0, fixed in 0.22.4; from 0.21.0, fixed in 0.21.11; versions 0.20.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/crates.io/rustls
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.