# RUSTSEC-2026-0285 - TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries

Source: https://junglewise.ai/threats/rustsec-2026-0285-tls-1-3-handshake-messages-incorrectly-accepted-f91ddbee  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2026-09-14

TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries

Technologies: [rustls (crates.io)](https://junglewise.ai/threats/technologies/rustls). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 14 September 2026.

**Which products and versions are affected?** rustls (crates.io) SEMVER:introduced=0.23.13,fixed=0.23.45.

**Is there a fix for This vulnerability?** Yes. rustls (crates.io): upgrade to 0.23.45 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected?** Check whether you run rustls (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- rustls (crates.io): upgrade to 0.23.45 or later

  ```sh
  cargo update -p rustls
  ```


## Affected products

- rustls (crates.io) SEMVER:introduced=0.23.13,fixed=0.23.45

## Related threats

- [rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert](https://junglewise.ai/threats/rustls-ech-rejection-can-expose-buffered-application-data-to-bdce2178)
- [rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a…](https://junglewise.ai/threats/rustls-an-unauthenticated-serverhello-poisons-the-per-name-key-exchange-5b941b84)
- [Rustls client session debug formatting information disclosure](https://junglewise.ai/threats/rustls-session-debug-formatting-exposes-tls-master-secrets-and-6519d2da)
- [Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.](https://junglewise.ai/threats/rustls-brotli-certificate-decompression-can-allocate-an-attacker-e90b700c)
- [RUSTSEC-2026-0346 - `Debug` impls for client session values expose TLS secrets](https://junglewise.ai/threats/rustsec-2026-0346-debug-impls-for-client-session-values-expose-tls-01a9a3b6)