rustls vulnerabilities (crates.io)
7 vulnerabilities.
-
rustlscrates.io rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share 3.7 Low -
rustlscrates.io rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert 2.3 Low -
rustlscrates.io Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication. 3.7 Low -
rustlscrates.io Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs 4.0 Medium -
rustlscrates.io Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries 5.3 Medium -
rustlscrates.io Rustls: rustls network-reachable panic in `acceptor::accept` 5.3 Medium -
rustlscrates.io Rustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client input 7.5 High