PT-2026-139894
CVE-2026-123613
·
Published
2026-09-14
·
Updated
2026-11-08
Description by
CVSS 4.0
6.9
MediumMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
Rustls versions 0.23.13 through 0.23.44
Description
Rustls accepts TLS 1.3 handshake messages at an incorrect encryption level when they follow a key-changing message within the same record. This occurs because the
Deframer::aligned function fails to enforce RFC 8446 record-boundary alignment. Consequently, a peer or on-path attacker can bundle a plaintext EncryptedExtensions message with the ServerHello, which the system then accepts without encryption.Recommendations
Update Rustls to version 0.23.45.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾