# rustls (crates.io) vulnerabilities Source: https://junglewise.ai/threats/technologies/rustls Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/rustls.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 12 vulnerabilities in rustls (crates.io): 0 in the last 7 days and 10 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, rustls: ECH rejection can expose buffered application data to authenticated…, was published on 27 October 2026. 8 vulnerabilities in the last four weeks, up 300% on the four before (2). ## Counts - Last 7 days: 0 - Last 30 days: 8 - Last 90 days: 10 - All time: 12 (0 critical, 0 exploited in the wild) ## About rustls (crates.io) Modern TLS protocol implementation written in pure Rust. ## Latest rustls (crates.io) vulnerabilities - [rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert](https://junglewise.ai/threats/rustls-ech-rejection-can-expose-buffered-application-data-to-bdce2178) (low, CVSS 3.1, published 27 Oct 2026) - [rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a…](https://junglewise.ai/threats/rustls-an-unauthenticated-serverhello-poisons-the-per-name-key-exchange-5b941b84) (low, CVSS 3.7, published 27 Oct 2026) - [Rustls client session debug formatting information disclosure](https://junglewise.ai/threats/rustls-session-debug-formatting-exposes-tls-master-secrets-and-6519d2da) (medium, CVSS 4, published 27 Oct 2026) - [Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.](https://junglewise.ai/threats/rustls-brotli-certificate-decompression-can-allocate-an-attacker-e90b700c) (low, CVSS 3.7, published 27 Oct 2026) - [RUSTSEC-2026-0346 - `Debug` impls for client session values expose TLS secrets](https://junglewise.ai/threats/rustsec-2026-0346-debug-impls-for-client-session-values-expose-tls-01a9a3b6) (low, CVSS 3.1, published 14 Oct 2026) - [RUSTSEC-2026-0349 - Unauthenticated ServerHello can downgrade later connections to classical key exchange](https://junglewise.ai/threats/rustsec-2026-0349-unauthenticated-serverhello-can-downgrade-later-4fb5a3af) (low, CVSS 3.1, published 14 Oct 2026) - [RUSTSEC-2026-0348 - Brotli certificate decompression can allocate up to 1 GiB before authentication](https://junglewise.ai/threats/rustsec-2026-0348-brotli-certificate-decompression-can-allocate-up-to-1-55027bf9) (low, CVSS 3.1, published 14 Oct 2026) - [RUSTSEC-2026-0347 - Buffered application data sent to outer server after ECH rejection](https://junglewise.ai/threats/rustsec-2026-0347-buffered-application-data-sent-to-outer-server-after-81074b5b) (low, CVSS 3.1, published 14 Oct 2026) - [Rustls TLS 1.3 handshake message validation bypass across encryption levels](https://junglewise.ai/threats/rustls-tls-1-3-handshake-messages-incorrectly-accepted-across-4eccbdca) (medium, CVSS 5.3, published 5 Oct 2026) - [RUSTSEC-2026-0285 - TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries](https://junglewise.ai/threats/rustsec-2026-0285-tls-1-3-handshake-messages-incorrectly-accepted-f91ddbee) (low, CVSS 3.1, published 14 Sep 2026) - [CVE-2024-11738: RUSTSEC-2024-0399 - rustls network-reachable panic in `Acceptor::accept`](https://junglewise.ai/threats/cve-2024-11738-rustls-network-reachable-panic-in-acceptor-accept) (medium, CVSS 4, published 22 Nov 2024) - [CVE-2024-32650: RUSTSEC-2024-0336 - `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input](https://junglewise.ai/threats/cve-2024-32650-denial-of-service-vulnerability-in-rustls-library) (low, CVSS 3.1, published 19 Apr 2024) ## Most severe rustls (crates.io) vulnerabilities - [Rustls TLS 1.3 handshake message validation bypass across encryption levels](https://junglewise.ai/threats/rustls-tls-1-3-handshake-messages-incorrectly-accepted-across-4eccbdca) (medium, CVSS 5.3, published 5 Oct 2026) - [CVE-2024-11738: RUSTSEC-2024-0399 - rustls network-reachable panic in `Acceptor::accept`](https://junglewise.ai/threats/cve-2024-11738-rustls-network-reachable-panic-in-acceptor-accept) (medium, CVSS 4, published 22 Nov 2024) - [Rustls client session debug formatting information disclosure](https://junglewise.ai/threats/rustls-session-debug-formatting-exposes-tls-master-secrets-and-6519d2da) (medium, CVSS 4, published 27 Oct 2026) - [rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a…](https://junglewise.ai/threats/rustls-an-unauthenticated-serverhello-poisons-the-per-name-key-exchange-5b941b84) (low, CVSS 3.7, published 27 Oct 2026) - [Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.](https://junglewise.ai/threats/rustls-brotli-certificate-decompression-can-allocate-an-attacker-e90b700c) (low, CVSS 3.7, published 27 Oct 2026) - [CVE-2024-32650: RUSTSEC-2024-0336 - `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input](https://junglewise.ai/threats/cve-2024-32650-denial-of-service-vulnerability-in-rustls-library) (low, CVSS 3.1, published 19 Apr 2024) - [rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert](https://junglewise.ai/threats/rustls-ech-rejection-can-expose-buffered-application-data-to-bdce2178) (low, CVSS 3.1, published 27 Oct 2026) - [RUSTSEC-2026-0346 - `Debug` impls for client session values expose TLS secrets](https://junglewise.ai/threats/rustsec-2026-0346-debug-impls-for-client-session-values-expose-tls-01a9a3b6) (low, CVSS 3.1, published 14 Oct 2026) - [RUSTSEC-2026-0349 - Unauthenticated ServerHello can downgrade later connections to classical key exchange](https://junglewise.ai/threats/rustsec-2026-0349-unauthenticated-serverhello-can-downgrade-later-4fb5a3af) (low, CVSS 3.1, published 14 Oct 2026) - [RUSTSEC-2026-0348 - Brotli certificate decompression can allocate up to 1 GiB before authentication](https://junglewise.ai/threats/rustsec-2026-0348-brotli-certificate-decompression-can-allocate-up-to-1-55027bf9) (low, CVSS 3.1, published 14 Oct 2026) ## Vulnerabilities per week 8 vulnerabilities in the last four weeks, up 300% on the four before (2). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 4 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 4 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other crates.io technologies - [surrealdb (crates.io)](https://junglewise.ai/threats/technologies/surrealdb): 83 vulnerabilities - [wasmtime (crates.io)](https://junglewise.ai/threats/technologies/wasmtime): 67 vulnerabilities - [deno (crates.io)](https://junglewise.ai/threats/technologies/deno): 39 vulnerabilities - [zebrad (crates.io)](https://junglewise.ai/threats/technologies/zebrad): 27 vulnerabilities - [russh (crates.io)](https://junglewise.ai/threats/technologies/crates-io-russh): 26 vulnerabilities - [openssl-src (crates.io)](https://junglewise.ai/threats/technologies/openssl-src): 26 vulnerabilities - [openssl (crates.io)](https://junglewise.ai/threats/technologies/crates-io-openssl): 25 vulnerabilities - [rustfs (crates.io)](https://junglewise.ai/threats/technologies/rustfs): 25 vulnerabilities - [coreutils (crates.io)](https://junglewise.ai/threats/technologies/crates-io-coreutils): 21 vulnerabilities - [ckb (crates.io)](https://junglewise.ai/threats/technologies/ckb): 19 vulnerabilities - [apollo-router (crates.io)](https://junglewise.ai/threats/technologies/apollo-router): 13 vulnerabilities - [deepseek-tui (crates.io)](https://junglewise.ai/threats/technologies/deepseek-tui): 13 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "rustls (crates.io) vulnerabilities", https://junglewise.ai/threats/technologies/rustls, 9 November 2026.