UBUNTU-CVE-2026-123612: Medium severity ubuntu/rust-rustls vulnerability
rustls 0.23.44 and 0.23.45 contain an information disclosure vulnerability that sends application data buffered before the handshake completes to the client-facing server when Encrypted Client Hello is rejected. Because starttraffic() queues plaintext from ClientConnection::writer() before sending the echrequired alert, the authenticated publicname server receives data intended for the inner server.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The severity vector indicates local attack access and high privileges are required. No user interaction is required.
Which deployments are exposed to the disclosure?
Exposure requires Encrypted Client Hello to be rejected while application data has been buffered before the handshake completes. In that case, the authenticated public_name server can receive plaintext intended for the inner server.