All vulnerabilities
GHSA-c8m5-c952-6cm4RUSTSEC-2026-0346

Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs

rustlsrustLibraries & packages
Open in ThreatlineRecord JSON
CVSS
4.0Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in0.23.46Also 0.24.0-dev.2GitHub
Published27 Oct 2026Updated 27 Oct 2026GitHub

What fixes it

  • 0.23.46rustls, rustGitHub
  • 0.24.0-dev.2rustls, rustGitHub
  • 0.23.46rustls, crates.ioOSVcargo update -p rustls --precise 0.23.46
  • 0.24.0-dev.2rustls, crates.ioOSVcargo update -p rustls --precise 0.24.0-dev.2

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

Formatting a client session value with Debug exposes its TLS 1.2 master secret or TLS 1.3 resumption PSK. A custom session store that logs these values can disclose keys to readers of the logs. Ordinary connection and built-in cache diagnostics remain redacted, and the session-store interface already warns that its values are sensitive.

Details

Derived formatters traverse the session's secret-bearing fields. This conflicts with the project's explicit key-material redaction policy.

Proof of concept

Custom ClientSessionStore implementations could leak secret data by using the provided Tls12ClientSessionValue or Tls13ClientSessionValue in a way that triggers its implementation of the Debug trait.

Impact

Such store implementations could leak the master secret for the TLS connection.

Acknowledgement

Thanks to OpenAI [OutboundDisclosures@openai.com](mailto:OutboundDisclosures@openai.com) for the disclosure.

Text from GitHub Advisory Database

Affected versions 4

  • rustls, rust< 0.23.46GitHub
  • rustls, rust>= 0.24.0-dev.1, < 0.24.0-dev.2GitHub
  • rustls, crates.iofrom first release, fixed in 0.23.46OSV
  • rustls, crates.iofrom 0.24.0-dev.1, fixed in 0.24.0-dev.2OSV

References 8