Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| rustls | rustls | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Sun, 08 Nov 2026 01:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | rustls 0.23.44 and 0.23.45 contain an information disclosure vulnerability that sends application data buffered before the handshake completes to the client-facing server when Encrypted Client Hello is rejected. Because start_traffic() queues plaintext from ClientConnection::writer() before sending the ech_required alert, the authenticated public_name server receives data intended for the inner server. | |
| Title | rustls 0.23.44 and 0.23.45 ECH Rejection Application Data Disclosure | |
| First Time appeared |
Rustls Project
Rustls Project rustls |
|
| Weaknesses | CWE-696 | |
| CPEs | cpe:2.3:a:rustls_project:rustls:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Rustls Project
Rustls Project rustls |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-11-08T01:38:36.873Z
Reserved: 2026-11-06T01:02:39.794Z
Link: CVE-2026-123612
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-696
Incorrect Behavior Order