{"id":"CVE-2026-123609","aliases":["AZL-113167","AZL-113185","AZL-113272","AZL-113287","AZL-113308","DEBIAN-CVE-2026-123609","EUVD-2026-119368","GHSA-67mj-442h-2gp6","GHSA-c8m5-c952-6cm4","RUSTSEC-2026-0346","UBUNTU-CVE-2026-123609"],"status":"published","title":"Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 Secret Exposure via Debug","description":"Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.","severity":{"version":"4.0","score":4.1,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00101,"percentile":0.00894,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-212"],"published":"2026-10-14T12:00:00Z","modified":"2026-11-11T14:17:32Z","fixes":[{"ecosystem":"crates.io","package":"rustls","fixed_in":["0.23.46","0.24.0-dev.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"rustls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.46"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"rustls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.24.0-dev.1"},{"fixed":"0.24.0-dev.2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kata-containers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.1.0.kata1-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kata-containers-cc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.15.0.aks0-23"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.75.0-31"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.85.0"},{"last_affected":"1.98.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust-afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.8.2-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rust-rustls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.20.8-4","0.20.8-4.1","0.20.8-4.2","0.21.10-1","0.21.12-1","0.21.12-2","0.21.12-3","0.21.12-4","0.21.12-5","0.21.12-6","0.21.12-7","0.21.12-8","0.21.12-9","0.21.5-1","0.21.5-2","0.21.5-3","0.21.5-4","0.21.5-5","0.21.6-1","0.21.6-2","0.21.6-3","0.21.6-4","0.21.7-1","0.21.8-1","0.21.8-2","0.21.8-3","0.21.8-3.1","0.21.9-1","0.23.16-1","0.23.20+ds-1","0.23.20+ds-10","0.23.20+ds-2","0.23.20+ds-3","0.23.20+ds-4","0.23.20+ds-5","0.23.20+ds-6","0.23.20+ds-7","0.23.20+ds-8","0.23.20+ds-9","0.23.25+ds-1","0.23.26+ds-1","0.23.31+ds-1","0.23.31+ds-2","0.23.31+ds-3","0.23.31+ds-4","0.23.31+ds-5","0.23.31+ds-6","0.23.31+ds-7","0.23.32+ds-1","0.23.32+ds-2","0.23.33+ds-1","0.23.33+ds-2","0.23.33+ds-3","0.23.33+ds-4","0.23.35+ds-1","0.23.36+ds-1","0.23.37+ds-1","0.23.37+ds-2","0.23.37+ds-3","0.23.38+ds-1","0.23.40+ds-1","0.23.41+ds-1","0.23.43+ds-1","0.23.45+ds-1","0.23.46+ds-1"]},{"source":"osv","ecosystem":"Debian:13","package":"rust-rustls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.26+ds-1","0.23.31+ds-1","0.23.31+ds-2","0.23.31+ds-3","0.23.31+ds-4","0.23.31+ds-5","0.23.31+ds-6","0.23.31+ds-7","0.23.32+ds-1","0.23.32+ds-2","0.23.33+ds-1","0.23.33+ds-2","0.23.33+ds-3","0.23.33+ds-4","0.23.35+ds-1","0.23.36+ds-1","0.23.37+ds-1","0.23.37+ds-2","0.23.37+ds-3","0.23.38+ds-1","0.23.40+ds-1","0.23.41+ds-1","0.23.43+ds-1","0.23.45+ds-1","0.23.46+ds-1"]},{"source":"osv","ecosystem":"Debian:14","package":"rust-rustls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.26+ds-1","0.23.31+ds-1","0.23.31+ds-2","0.23.31+ds-3","0.23.31+ds-4","0.23.31+ds-5","0.23.31+ds-6","0.23.31+ds-7","0.23.32+ds-1","0.23.32+ds-2","0.23.33+ds-1","0.23.33+ds-2","0.23.33+ds-3","0.23.33+ds-4","0.23.35+ds-1","0.23.36+ds-1","0.23.37+ds-1","0.23.37+ds-2","0.23.37+ds-3","0.23.38+ds-1","0.23.40+ds-1","0.23.41+ds-1","0.23.43+ds-1","0.23.45+ds-1","0.23.46+ds-1"]},{"source":"osv","ecosystem":"crates.io","package":"rustls","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.23.46"}]}]},{"source":"osv","ecosystem":"crates.io","package":"rustls","ranges":[{"type":"SEMVER","events":[{"introduced":"0.24.0-dev.1"},{"fixed":"0.24.0-dev.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"rustls","ranges":[{"type":"SEMVER","events":[{"introduced":"0.21.0"},{"fixed":"0.23.46"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-rustls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.21.6-3","0.21.7-1","0.21.9-1","0.21.10-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-rustls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.36+ds-1","0.23.41+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-rustls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.26+ds-1","0.23.33+ds-3build2","0.23.35+ds-1","0.23.35+ds-1build1","0.23.36+ds-1"]}],"products":[{"vendor":"rustls","product":"rustls"},{"vendor":"rustls project","product":"rustls"}],"references":[{"url":"https://github.com/rustls/rustls/security/advisories/GHSA-c8m5-c952-6cm4","tags":["vendor-advisory","advisory","web","report"]},{"url":"https://www.vulncheck.com/advisories/rustls-before-0.23.46-and-0.24.0-dev.1-before-0.24.0-dev.2-secret-exposure-via-debug","tags":["third-party-advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123609","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-67mj-442h-2gp6"},{"url":"https://github.com/rustls/rustls/pull/3299","tags":["web","report"]},{"url":"https://github.com/rustls/rustls/pull/3354","tags":["web"]},{"url":"https://github.com/rustls/rustls/commit/dcdb9464d376f45f42a94a5f837cda1506449f23","tags":["web"]},{"url":"https://github.com/rustls/rustls/commit/f5f7bf5078a7edcbd81a9e82a97f2bd14dc1c855","tags":["web"]},{"url":"https://github.com/rustls/rustls/releases/tag/v/0.23.46","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0346.html","tags":["web","advisory","report"]},{"url":"https://github.com/advisories/GHSA-c8m5-c952-6cm4","tags":["report"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123609.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-123609","tags":["advisory"]},{"url":"https://github.com/rustls/rustls","tags":["package"]},{"url":"https://crates.io/crates/rustls","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-123609","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-123609","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-123609","title":"Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 Secret Exposure via Debug","description":"Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.","status":"published","published":"2026-11-08T01:38:34.811Z","modified":"2026-11-10T17:56:51.627Z","cvss":[{"version":"4.0","score":4.1,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-212"],"updated_at":"2026-11-08T02:36:49.037074Z"}],"euvd":[{"id":"EUVD-2026-119368","description":"Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.","status":"published","published":"2026-11-08T01:38:34Z","modified":"2026-11-10T17:56:51Z","cvss":[{"version":"4.0","score":4.1,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-08T06:12:04.155226Z"}],"ghsa":[{"id":"GHSA-67mj-442h-2gp6","title":"Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure...","description":"Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.","status":"published","published":"2026-11-08T03:30:37Z","modified":"2026-11-08T03:30:44Z","cvss":[{"version":"4.0","score":4.1,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-212"],"updated_at":"2026-11-08T03:41:54.072675Z"},{"id":"GHSA-c8m5-c952-6cm4","title":"Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs","description":"### Summary\n\nFormatting a client session value with Debug exposes its TLS 1.2 master secret or TLS 1.3 resumption PSK. A custom session store that logs these values can disclose keys to readers of the logs. Ordinary connection and built-in cache diagnostics remain redacted, and the session-store interface already warns that its values are sensitive.\n\n### Details\n\nDerived formatters traverse the session's secret-bearing fields. This conflicts with the project's explicit [key-material redaction policy](https://github.com/rustls/rustls/blob/99f2358cae2954837dbb866faf6727de75489ab9/SECURITY.md#boundary-public-api).\n\n### Proof of concept\n\nCustom `ClientSessionStore` implementations could leak secret data by using the provided `Tls12ClientSessionValue` or `Tls13ClientSessionValue` in a way that triggers its implementation of the `Debug` trait.\n\n### Impact\n\nSuch store implementations could leak the master secret for the TLS connection.\n\n### Acknowledgement\nThanks to OpenAI [OutboundDisclosures@openai.com](mailto:OutboundDisclosures@openai.com) for the disclosure.","status":"published","published":"2026-10-27T16:08:47Z","modified":"2026-10-27T16:08:48Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-212"],"updated_at":"2026-11-02T14:41:37.912288Z"}],"nvd":[{"id":"CVE-2026-123609","description":"Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.","status":"published","published":"2026-11-08T02:16:56.083Z","modified":"2026-11-10T18:17:27.75Z","cvss":[{"version":"4.0","score":4.1,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-212"],"updated_at":"2026-11-10T20:21:09.207118Z"}],"osv":[{"id":"CVE-2026-123609","title":"Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 Secret Exposure via Debug","description":"Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.","status":"published","published":"2026-11-08T01:38:34.811Z","modified":"2026-11-11T02:30:34.705102312Z","cvss":[{"version":"4.0","score":4.1,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-212"],"updated_at":"2026-11-08T11:04:05.022583Z"},{"id":"DEBIAN-CVE-2026-123609","description":"Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.","status":"published","published":"2026-11-08T02:16:56.083Z","modified":"2026-11-11T10:00:53.742689659Z","cvss":[{"version":"4.0","score":4.1,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-11T10:35:16.464644Z"},{"id":"GHSA-c8m5-c952-6cm4","title":"Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs","description":"### Summary\n\nFormatting a client session value with Debug exposes its TLS 1.2 master secret or TLS 1.3 resumption PSK. A custom session store that logs these values can disclose keys to readers of the logs. Ordinary connection and built-in cache diagnostics remain redacted, and the session-store interface already warns that its values are sensitive.\n\n### Details\n\nDerived formatters traverse the session's secret-bearing fields. This conflicts with the project's explicit [key-material redaction policy](https://github.com/rustls/rustls/blob/99f2358cae2954837dbb866faf6727de75489ab9/SECURITY.md#boundary-public-api).\n\n### Proof of concept\n\nCustom `ClientSessionStore` implementations could leak secret data by using the provided `Tls12ClientSessionValue` or `Tls13ClientSessionValue` in a way that triggers its implementation of the `Debug` trait.\n\n### Impact\n\nSuch store implementations could leak the master secret for the TLS connection.\n\n### Acknowledgement\nThanks to OpenAI [OutboundDisclosures@openai.com](mailto:OutboundDisclosures@openai.com) for the disclosure.","status":"published","published":"2026-10-27T16:08:47Z","modified":"2026-11-08T10:55:36.514447652Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-212"],"updated_at":"2026-11-08T11:04:05.022583Z"},{"id":"RUSTSEC-2026-0346","title":"`Debug` impls for client session values expose TLS secrets","description":"The `Debug` implementations of `Tls12ClientSessionValue` and\n`Tls13ClientSessionValue` were derived, and so included the TLS 1.2 master\nsecret or TLS 1.3 resumption PSK in their output.\n\nCustom `ClientSessionStore` implementations that format these values with\n`Debug` (for example, when logging) could disclose these secrets to readers of\nthe logs. This conflicts with rustls's\n[key-material redaction policy](https://github.com/rustls/rustls/blob/99f2358cae2954837dbb866faf6727de75489ab9/SECURITY.md#boundary-public-api).\n\nOrdinary connection and built-in session cache `Debug` output is redacted and\nis not affected.","status":"published","published":"2026-10-14T12:00:00Z","modified":"2026-11-09T09:21:20Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-08T11:04:05.022583Z"},{"id":"UBUNTU-CVE-2026-123609","description":"Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-10T02:50:22.080083052Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium"},{"version":"4.0","score":4.1,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-10T03:18:58.105788Z"},{"id":"AZL-113167","title":"CVE-2026-123609 affecting package kata-containers 4.1.0.kata1-2","description":"Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.","status":"published","published":"2026-11-08T02:16:56Z","modified":"2026-11-11T14:17:32.431598706Z","updated_at":"2026-11-11T14:42:54.020399Z"},{"id":"AZL-113185","title":"CVE-2026-123609 affecting package kata-containers-cc 3.15.0.aks0-23","description":"Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.","status":"published","published":"2026-11-08T02:16:56Z","modified":"2026-11-11T14:17:32.278840591Z","updated_at":"2026-11-11T14:42:54.020399Z"},{"id":"AZL-113272","title":"CVE-2026-123609 affecting package rust 1.75.0-31","description":"Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.","status":"published","published":"2026-11-08T02:16:56Z","modified":"2026-11-11T14:17:32.377928514Z","updated_at":"2026-11-11T14:42:54.020399Z"},{"id":"AZL-113287","title":"CVE-2026-123609 affecting package rust 1.98.1-1","description":"Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.","status":"published","published":"2026-11-08T02:16:56Z","modified":"2026-11-11T14:17:32.803836165Z","updated_at":"2026-11-11T14:42:54.020399Z"},{"id":"AZL-113308","title":"CVE-2026-123609 affecting package rust-afterburn 5.8.2-2","description":"Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.","status":"published","published":"2026-11-08T02:16:56Z","modified":"2026-11-11T14:17:32.835582697Z","updated_at":"2026-11-11T14:42:54.020399Z"}]}}