CVE-2026-123609 · Package
NO FIX YET · SEE WHAT TO DO
Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 derive Debug formatting for client session values that hold secret key material. A custom ClientSessionStore that logs these values writes TLS 1.2 master secrets or TLS 1.3 resumption PSKs into log files, where anyone who reads the logs can take them.
first public Oct 14, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only applications that use Rustls with a custom ClientSessionStore that logs session values through Debug formatting are exposed. Applications that use the default session store, or that never log these values, are not affected by the leak. Teams should check their own session store code and any logging that dumps client session structures.
Not affected if default-session-store, no-session-value-logging
Who cares rust, rustls, tls
rustls at 0.23.x below 0.23.46, or 0.24.0-dev.1 below 0.24.0-dev.2.ClientSessionStore implementation that logs Tls12ClientSessionValue or Tls13ClientSessionValue with Debug formatting ({:?}).Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
rustls 0.23.46 for the 0.23 linerustls 0.24.0-dev.2 for the 0.24 development line