UBUNTU-CVE-2026-123609: Medium severity ubuntu/rust-rustls vulnerability
Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.
Affected Software
Event History
Frequently Asked Questions
Which deployments are realistically exposed to this issue?
The exposure is limited to applications using a custom ClientSessionStore implementation that logs Tls12ClientSessionValue or Tls13ClientSessionValue through derived Debug formatting. Log readers could then access leaked TLS 1.2 master secrets or TLS 1.3 resumption PSKs.
What conditions are required for an attacker to obtain the secret material?
An attacker needs the application to log the affected client session values and needs access to those logs. The provided data does not indicate that ordinary rustls use without such custom logging is affected.
How can I determine whether my application may already be affected?
Review custom ClientSessionStore implementations and application logging for Debug output of Tls12ClientSessionValue or Tls13ClientSessionValue. Inspect logs accessible to users or operators for any emitted client-session data.
What versions address the issue?
The issue affects rustls versions before 0.23.46 and 0.24.0-dev.1 versions before 0.24.0-dev.2. Updating to the applicable fixed version removes the vulnerable derived Debug formatting behavior.