rustls
crates.io7 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting rustlspage 1 of 1
- CVE-2024-11738MEDIUMCVSS 5.3EG 5.3fixed in 0.23.18 or 0.23.0, by version range2024-12-06
A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.
- CVE-2024-32650HIGHCVSS 7.5EG 7.5fixed in 0.23.5, 0.22.4 or 0.21.11, by version range2024-04-19
vulnerable: 0.20
Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately aft…
- CVE-2026-123609MEDIUMCVSS 4.0EG 4.0fixed in 0.23.46 or 0.24.0-dev.2, by version range2026-11-08
Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that…
- CVE-2026-123610LOWCVSS 3.7EG 3.7fixed in 0.23.46 or 0.24.0-dev.2, by version range2026-11-08
rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a ce…
- CVE-2026-123611LOWCVSS 3.7EG 3.7fixed in 0.23.46 or 0.24.0-dev.2, by version range2026-11-08
rustls before 0.23.46 contains a key exchange downgrade vulnerability that allows network attackers to poison the per-server-name key-exchange group record via an unauthenticated ServerHello. Attackers can answer one connection with a Serv…
- CVE-2026-123612LOWCVSS 2.3EG 2.3fixed in 0.23.46 or 0.24.0-dev.2, by version range2026-11-08
rustls 0.23.44 and 0.23.45 contain an information disclosure vulnerability that sends application data buffered before the handshake completes to the client-facing server when Encrypted Client Hello is rejected. Because start_traffic() que…
- CVE-2026-123613MEDIUMCVSS 5.3EG 5.3fixed in 0.23.452026-11-08
Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the same record, because Deframer::aligned does not enforce RFC 8446 record-boundary alignment. …
Check whether rustls is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for rustls CVEs against the assets you own.
Book a Demo →