UBUNTU-CVE-2026-123613: Medium severity ubuntu/rust-rustls vulnerability
Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the same record, because Deframer::aligned does not enforce RFC 8446 record-boundary alignment. A peer or on-path attacker can pack a plaintext EncryptedExtensions with the ServerHello, which rustls accepts unencrypted.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A malicious TLS peer can exploit it, and an on-path attacker may also be able to do so. Exploitation does not require privileges or user interaction.
What traffic pattern is required for exploitation?
The attacker must place a plaintext EncryptedExtensions handshake message after a key-changing ServerHello in the same TLS record. The affected rustls versions incorrectly accept that EncryptedExtensions message without encryption.
Which rustls versions are affected?
Rustls versions from 0.23.13 before 0.23.45 are affected. The listed Ubuntu software is ubuntu/rust-rustls.