CVE-2026-123609
Received Received - Intake

Information Disclosure in Rustls TLS Session Values

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123609
EUVD
EUVD-2026-119368

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
rustls rustls to 0.23.46 (exc)
rustls rustls From 0.24.0-dev.1 (exc) to 0.24.0-dev.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-212 The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Rustls before versions 0.23.46 and 0.24.0-dev.2 has an information disclosure flaw. When custom ClientSessionStore implementations log client session values, they may expose secret key material. Specifically, Tls12ClientSessionValue or Tls13ClientSessionValue logs can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs.

Impact Analysis

If you use Rustls in a system where custom session stores log session values, attackers with access to logs could extract secret keys. This may allow decryption of past or future TLS traffic, compromising confidentiality of sensitive data transmitted over the network.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or health data, violating GDPR and HIPAA requirements for data confidentiality and integrity. Organizations may face compliance violations, fines, or reputational damage if exploited.

Mitigation Strategies

Upgrade Rustls to version 0.23.46 or later for the 0.23.x branch, or to 0.24.0-dev.2 or later for the 0.24.x branch to address the information disclosure vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123609. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...