MEDIUM 4.1 NVD
CVE-2026-123609
Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session val
Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.
References
- https://github.com/rustls/rustls/security/advisories/GHSA-c8m5-c952-6cm4
- https://www.vulncheck.com/advisories/rustls-before-0.23.46-and-0.24.0-dev.1-before-0.24.0-
This medium severity vulnerability with a CVSS score of 4.1 was published on 2026-11-08 via NVD.
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.