Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 4, published 27 October 2026.

Which products and versions are affected?

rustls (crates.io) = 0.24.0-dev.1 and < 0.24.0-dev.2.

Is there a fix for This vulnerability?

Yes. rustls (crates.io): upgrade to 0.23.46 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked with local access, in a software library.

Check whether you run rustls (crates.io) or Rustls at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Rustls client session debug formatting information disclosure

Q: Is there a fix for This vulnerability?

Yes. rustls (crates.io): upgrade to 0.23.46 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked with local access, in a software library.

Q: Am I affected?

Check whether you run rustls (crates.io) or Rustls at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: medium · CVSS 4 · Published 2026-10-27

Rustls is a TLS library used to secure network communications. When session values are logged or displayed for debugging purposes, they can expose the master secrets used to encrypt TLS 1.2 connections or the PSKs used to resume TLS 1.3 connections. An attacker with access to application logs could potentially decrypt past communications or forge new sessions.

Technologies: rustls (crates.io), Rustls. Vendors: crates.io, Rustls.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 4, published 27 October 2026.
Which products and versions are affected?: rustls (crates.io) < 0.23.46, SEMVER:introduced=0,fixed=0.23.46; Rustls < 0.23.46, >= 0.24.0-dev.1 and < 0.24.0-dev.2.
Is there a fix for This vulnerability?: Yes. rustls (crates.io): upgrade to 0.23.46 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked with local access, in a software library.
Am I affected?: Check whether you run rustls (crates.io) or Rustls at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

rustls (crates.io): upgrade to 0.23.46 or later
```
cargo update -p rustls
```

Technical details

The Debug trait implementation in Rustls session types (Tls12ClientSessionValue and Tls13ClientSessionValue) traverses and exposes secret-bearing fields, violating the library's key-material redaction policy. This occurs when custom session store implementations log or format these session values. The vulnerability requires high privileges, high attack complexity, and user interaction, but results in complete exposure of confidentiality-critical secrets.

Affected products

Rustls Rustls < 0.23.46, >= 0.24.0-dev.1 and < 0.24.0-dev.2

Identifiers

GHSA-c8m5-c952-6cm4
RUSTSEC-2026-0346

Timeline

2026-10-14: disclosed
2026-10-27: advisory

References

https://github.com/rustls/rustls/security/advisories/GHSA-c8m5-c952-6cm4

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.