{"id":"RUSTSEC-2026-0346","revision":"27564dcea38c4f81a8225d3004276181","records":[{"revision":"27564dcea38c4f81a8225d3004276181","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0346","aliases":["GHSA-c8m5-c952-6cm4"],"title":"`Debug` impls for client session values expose TLS secrets","description":"The `Debug` implementations of `Tls12ClientSessionValue` and\n`Tls13ClientSessionValue` were derived, and so included the TLS 1.2 master\nsecret or TLS 1.3 resumption PSK in their output.\n\nCustom `ClientSessionStore` implementations that format these values with\n`Debug` (for example, when logging) could disclose these secrets to readers of\nthe logs. This conflicts with rustls's\n[key-material redaction policy](https://github.com/rustls/rustls/blob/99f2358cae2954837dbb866faf6727de75489ab9/SECURITY.md#boundary-public-api).\n\nOrdinary connection and built-in session cache `Debug` output is redacted and\nis not affected.","state":0,"publishedAt":"2026-10-14T12:00:00+00:00","modifiedAt":"2026-10-14T13:30:02.4806947+00:00","affected":[{"ecosystem":"crates.io","name":"rustls","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.21.0"},{"kind":"fixed","version":"0.23.46"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","score":null,"severity":null}],"references":["https://crates.io/crates/rustls","https://rustsec.org/advisories/RUSTSEC-2026-0346.html","https://github.com/rustls/rustls/pull/3299"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0346","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0346","identifiers":["RUSTSEC-2026-0346","GHSA-c8m5-c952-6cm4"]},"retained":false,"historicalAffected":[]}],"coverage":[]}