CVE-2026-123613
Received Received - Intake

Rustls TLS 1.3 Handshake Message Misalignment Vulnerability

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the same record, because Deframer::aligned does not enforce RFC 8446 record-boundary alignment. A peer or on-path attacker can pack a plaintext EncryptedExtensions with the ServerHello, which rustls accepts unencrypted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123613
EUVD
EUVD-2026-119372

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rustls rustls to 0.23.45 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Rustls library versions 0.23.13 to 0.23.44. It allows an attacker to send TLS 1.3 handshake messages at the wrong encryption level by placing a plaintext EncryptedExtensions message immediately after a key-changing message in the same record. Rustls incorrectly accepts these unencrypted messages due to improper record-boundary alignment enforcement in the Deframer::aligned function.

Impact Analysis

An attacker could exploit this to intercept or manipulate TLS handshake communications, potentially decrypting sensitive data or impersonating a server. This may lead to unauthorized access to confidential information or man-in-the-middle attacks on affected systems using vulnerable Rustls versions.

Mitigation Strategies

Immediately upgrade rustls to version 0.23.45 or later to address the TLS 1.3 handshake message parsing issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123613. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...