CVE-2026-123609
Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 Secret Exposure via Debug
CVSS Score
4.0
EPSS Score
0.0%
EPSS Percentile
0th
Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.
| CWE | CWE-212 |
| Vendor | rustls |
| Product | rustls |
| Published | Nov 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for rustls rustls
Be the first to know when new medium vulnerabilities affecting rustls rustls are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N Attack Vector
Local
Attack Complexity
High
Privileges Required
High
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
rustls / rustls
0 < 0.23.46 0.24.0-dev.1 < 0.24.0-dev.2