DEBIAN-CVE-2026-123613: Debian/rust-rustls vulnerability

Q: Which deployments are exposed?

Deployments using Rustls versions 0.23.13 through versions before 0.23.45 are affected when processing TLS 1.3 handshakes.

Q: What access does an attacker need?

Exploitation requires either a malicious peer or an attacker positioned on the network path. The attacker must be able to send a crafted TLS 1.3 record containing a key-changing message followed by a plaintext EncryptedExtensions message.

Q: How can I determine whether an installation is affected?

Check the Rustls version used by the Debian rust-rustls package or by the affected application. Versions from 0.23.13 up to, but not including, 0.23.45 are within the affected range.

Published Nov 8, 2026

Updated

Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the same record, because Deframer::aligned does not enforce RFC 8446 record-boundary alignment. A peer or on-path attacker can pack a plaintext EncryptedExtensions with the ServerHello, which rustls accepts unencrypted.

Affected Software

3 affected componentsFixes available

debian/rust-rustls*

debian/rust-rustls<0.23.45+ds-1

0.23.45+ds-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-rustls to a version that resolves this vulnerability.
Fixed in 0.23.45+ds-1

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed?

Deployments using Rustls versions 0.23.13 through versions before 0.23.45 are affected when processing TLS 1.3 handshakes.

What access does an attacker need?

Exploitation requires either a malicious peer or an attacker positioned on the network path. The attacker must be able to send a crafted TLS 1.3 record containing a key-changing message followed by a plaintext EncryptedExtensions message.

How can I determine whether an installation is affected?

Check the Rustls version used by the Debian rust-rustls package or by the affected application. Versions from 0.23.13 up to, but not including, 0.23.45 are within the affected range.

DEBIAN-CVE-2026-123613: Debian/rust-rustls vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What access does an attacker need?

How can I determine whether an installation is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What access does an attacker need?

How can I determine whether an installation is affected?