RUSTSEC-2026-0346

Debug impls for client session values expose TLS secrets

Reported

October 14, 2026

Issued

October 14, 2026

Package

rustls (crates.io)

Type

Vulnerability

Categories

crypto-failure

Aliases

GHSA-c8m5-c952-6cm4

References

https://github.com/rustls/rustls/pull/3299

CVSS Score

4 MEDIUM

CVSS Details

Attack Vector: Local
Attack Complexity: High
Privileges Required: High
User Interaction: Required
Scope: Unchanged
Confidentiality Impact: High
Integrity Impact: None
Availability Impact: None

CVSS Vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N

Patched

>=0.23.46

Unaffected

<0.21.0

Description

The Debug implementations of Tls12ClientSessionValue and Tls13ClientSessionValue were derived, and so included the TLS 1.2 master secret or TLS 1.3 resumption PSK in their output.

Custom ClientSessionStore implementations that format these values with Debug (for example, when logging) could disclose these secrets to readers of the logs. This conflicts with rustls's key-material redaction policy.

Ordinary connection and built-in session cache Debug output is redacted and is not affected.

Advisory available under CC0-1.0 license.