Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: rustls 0.23.46 Clear all filters
TI-2026-86754 CVE-2026-123612 · GHSA-jrx3-hh25-gg3m

Application data sent to public_name server when rustls rejects ECH

Priority LOW 20

rustls 0.23.44 and 0.23.45 contain an information disclosure vulnerability that sends application data buffered before the handshake completes to the client-facing server when Encrypted Client Hello is rejected.

CVSS 4.0MEDIUM 4.6 Local High privileges No interaction EPSS 0.0011 Published 2026-11-08 Fixed in 0.23.46 CWE-696
TI-2026-86753 CVE-2026-123611 · GHSA-jh53-vxwq-v4wp

Key exchange downgrade in rustls via unauthenticated ServerHello

Priority LOW 27

rustls before 0.23.46 contains a key exchange downgrade vulnerability that allows network attackers to poison the per-server-name key-exchange group record via an unauthenticated ServerHello.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00188 Published 2026-11-08 Fixed in 0.23.46 CWE-757
TI-2026-86752 CVE-2026-123610 · GHSA-gg47-62fq-vrhp

Uncontrolled memory allocation in rustls Brotli certificate decompression

Priority LOW 27

rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00165 Published 2026-11-08 Fixed in 0.23.46 CWE-770