EUVD-2026-119368Published
Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 Secret Exposure via Debug
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-123609 · CVE overview and exploitation status
cve-program · CVE-2026-123609
- https://github.com/rustls/rustls/security/advisories/GHSA-c8m5-c952-6cm4
- https://www.vulncheck.com/advisories/rustls-before-0.23.46-and-0.24.0-dev.1-before-0.24.0-dev.2-secret-exposure-via-debug
euvd · EUVD-2026-119368
- https://github.com/rustls/rustls/security/advisories/GHSA-c8m5-c952-6cm4
- https://www.vulncheck.com/advisories/rustls-before-0.23.46-and-0.24.0-dev.1-before-0.24.0-dev.2-secret-exposure-via-debug
nvd · CVE-2026-123609
- https://github.com/rustls/rustls/security/advisories/GHSA-c8m5-c952-6cm4
- https://www.vulncheck.com/advisories/rustls-before-0.23.46-and-0.24.0-dev.1-before-0.24.0-dev.2-secret-exposure-via-debug
osv · GHSA-c8m5-c952-6cm4
- https://github.com/rustls/rustls/security/advisories/GHSA-c8m5-c952-6cm4
- https://github.com/rustls/rustls/pull/3299
- https://github.com/rustls/rustls/pull/3354
- https://github.com/rustls/rustls/commit/dcdb9464d376f45f42a94a5f837cda1506449f23
- https://github.com/rustls/rustls/commit/f5f7bf5078a7edcbd81a9e82a97f2bd14dc1c855
- https://github.com/rustls/rustls
- https://github.com/rustls/rustls/releases/tag/v/0.23.46
- https://rustsec.org/advisories/RUSTSEC-2026-0346.html
osv · RUSTSEC-2026-0346
Related changes
Linked by CVE identifier- Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that … · Advisory content revised · 14 Nov 2026
- Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that … · Advisory content revised · 14 Nov 2026
- Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that … · Advisory content revised · 12 Nov 2026
- Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 Secret Exposure via Debug · Newly collected advisory · 8 Nov 2026
- Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs · Advisory content revised · 8 Nov 2026
- `Debug` impls for client session values expose TLS secrets · Advisory content revised · 8 Nov 2026