CVE-2026-123609

medium

Description

Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.

References

https://www.vulncheck.com/advisories/rustls-before-0.23.46-and-0.24.0-dev.1-before-0.24.0-dev.2-secret-exposure-via-debug

https://github.com/rustls/rustls/security/advisories/GHSA-c8m5-c952-6cm4

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-119368

Details

Source: Mitre, NVD

Published: 2026-11-08

Updated: 2026-11-08

Risk Information

CVSS v2

Base Score: 3.7

Vector: CVSS2#AV:L/AC:H/Au:M/C:C/I:N/A:N

Severity: Low

CVSS v3

Base Score: 4

Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N

Severity: Medium

CVSS v4

Base Score: 4.1

Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.00101