Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

GHSA-2mjx-qc3c-rqvc

RUSTSEC-2026-0285

osv · GHSA-2mjx-qc3c-rqvc

• https://github.com/rustls/rustls/security/advisories/GHSA-2mjx-qc3c-rqvc
• https://github.com/rustls/rustls/pull/3265
• https://github.com/golang/go/commit/5046bdf8a612b35a2c1a9e168054c1d5c65e7dd7
• https://github.com/rustls/rustls/commit/98456aea708a7e3c6151e00ca2d4428e7a58257a
• https://github.com/rustls/rustls
• https://github.com/rustls/rustls/releases/tag/v/0.23.45
• https://rustsec.org/advisories/RUSTSEC-2026-0285.html

osv · RUSTSEC-2026-0285

• https://crates.io/crates/rustls
• https://rustsec.org/advisories/RUSTSEC-2026-0285.html
• https://github.com/rustls/rustls/pull/3265

No related operational record is retained in the current change model.