CVE-2026-123609
Published:November 08, 2026
Updated:November 09, 2026
Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.
Affected Packages
https://github.com/rustls/rustls.git (GITHUB):
Affected version(s) >=v/0.21.0-alpha.1 <v/0.23.46 || >=v/0.22.0 <v/0.23.46 || >=v/0.23.0 <v/0.23.46Fix Suggestion:
Update to version v/0.23.46https://github.com/rustls/rustls.git (GITHUB):
Affected version(s) =v/0.24.0-alpha.1 <v/0.24.0-dev.2Fix Suggestion:
Update to version v/0.24.0-dev.2rustls (RUST):
Affected version(s) >=0.24.0-dev.0 <0.24.0-dev.2Fix Suggestion:
Update to version 0.24.0-dev.2rustls (RUST):
Affected version(s) >=0.23.0 <0.23.46 || >=0.21.0-alpha.1 <0.23.46 || >=0.22.0-alpha.1 <0.23.46Fix Suggestion:
Update to version 0.23.46Related Resources (12)
Do you need more information?
Contact UsCVSS v4
Base Score:
4.1
Attack Vector
LOCAL
Attack Complexity
HIGH
Attack Requirements
PRESENT
Privileges Required
HIGH
User Interaction
PASSIVE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
NONE
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
4
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE
Weakness Type (CWE)
Improper Removal of Sensitive Information Before Storage or Transfer
EPSS
Base Score:
0.10