RUSTSEC-2026-0346
impls for client session values expose TLS secrets
Published Oct 14, 2026 · updated Oct 14, 2026
The implementations of and were derived, and so included the TLS 1.2 master secret or TLS 1.3 resumption PSK in their output. Custom implementations that format these values with (for example, when logging) could disclose these secrets to readers of the logs. This conflicts with rustls's [key-material redaction policy](https://github.com/rustls/rustls/blob/99f2358cae2954837dbb866faf6727de75489ab9/SECURITY.md#boundary-public-api). Ordinary connection and built-in session cache output is redacted and is not affected.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · GitHub Advisory Database
Detected
The implementations of and were derived, and so included the TLS 1.2 master secret or TLS 1.3 resumption PSK in their output. Custom implementations that format these values with (for example, when logging) could disclose these secrets to readers of the logs. This conflicts with rustls's [key-material redaction policy](https://github.com/rustls/rustls/blob/99f2358cae2954837dbb866faf6727de75489ab9/
Oct 14, 2026 · GitHub Advisory Database
Fix available
rustls fixed in 0.23.46
Oct 14, 2026 · GitHub Advisory Database
Fix available
rustls fixed in 0.23.46
Oct 14, 2026 · GitHub Advisory Database
Updated
The implementations of and were derived, and so included the TLS 1.2 master secret or TLS 1.3 resumption PSK in their output. Custom implementations that format these values with (for example, when logging) could disclose these secrets to readers of the logs. This conflicts with rustls's [key-material redaction policy](https://github.com/rustls/rustls/blob/99f2358cae2954837dbb866faf6727de75489ab9/
Affected
- crates.io rustls0.21.0 → 0.23.46
Sources
- GitHub Advisory DatabaseGHSA-c8m5-c952-6cm4
GitHub Advisory Database record mirrored by OSV.
github.com - OSV.devRUSTSEC-2026-0346
impls for client session values expose TLS secrets
osv.dev