rustls (crates.io)
Advisories
21
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 0.24.0-dev.2 or later clears every advisory below that has a fix.
Upgrade commands
cargo
cargo update -p rustls --precise 0.24.0-dev.2Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-vp88-798v-h67f rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert |
Low | >= 0.24.0-dev.1, < 0.24.0-dev.2 | 0.24.0-dev.2 |
| GHSA-vp88-798v-h67f rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert |
Low | >= 0.23.44, < 0.23.46 | 0.23.46 |
| GHSA-c8m5-c952-6cm4 Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs |
Medium | < 0.23.46 | 0.23.46 |
| GHSA-c8m5-c952-6cm4 Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs |
Medium | >= 0.24.0-dev.1, < 0.24.0-dev.2 | 0.24.0-dev.2 |
| GHSA-c8m5-c952-6cm4 Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs |
Medium | >= 0.21.0, < 0.23.46 | 0.23.46 |
| GHSA-h2v8-394m-p7vv Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication. |
Low | < 0.23.46 | 0.23.46 |
| GHSA-h2v8-394m-p7vv Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication. |
Low | >= 0.24.0-dev.1, < 0.24.0-dev.2 | 0.24.0-dev.2 |
| GHSA-h2v8-394m-p7vv Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication. |
Low | >= 0.23.9, < 0.23.46 | 0.23.46 |
| GHSA-w44r-93j7-qv28 rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share |
Low | < 0.23.46 | 0.23.46 |
| GHSA-w44r-93j7-qv28 rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share |
Low | >= 0.24.0-dev.1, < 0.24.0-dev.2 | 0.24.0-dev.2 |
| GHSA-w44r-93j7-qv28 rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share |
Low | >= 0.0.0-0, < 0.23.46 | 0.23.46 |
| GHSA-vp88-798v-h67f rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert |
Low | >= 0.23.44, < 0.23.46 | 0.23.46 |
| GHSA-2mjx-qc3c-rqvc Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries |
Medium | >= 0.23.13, < 0.23.45 | 0.23.45 |
| GHSA-2mjx-qc3c-rqvc Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries |
Medium | >= 0.23.13, < 0.23.45 | 0.23.45 |
| GHSA-qg5g-gv98-5ffh rustls network-reachable panic in `Acceptor::accept` |
High EPSS 0.73% |
>= 0.23.13, < 0.23.18 | 0.23.18 |
| GHSA-qg5g-gv98-5ffh rustls network-reachable panic in `Acceptor::accept` |
High EPSS 0.73% |
>= 0.23.0, < 0.23.0>= 0.23.13, < 0.23.18 | 0.23.00.23.18 |
| GHSA-6g7w-8wpp-frhj Denial of Service Vulnerability in Rustls Library |
High EPSS 0.95% |
>= 0.21.0, < 0.21.11 | 0.21.11 |
| GHSA-6g7w-8wpp-frhj Denial of Service Vulnerability in Rustls Library |
High EPSS 0.95% |
>= 0.23.0, < 0.23.5 | 0.23.5 |
| GHSA-6g7w-8wpp-frhj Denial of Service Vulnerability in Rustls Library |
High EPSS 0.95% |
>= 0.0.0-0, < 0.21.11>= 0.22.0, < 0.22.4>= 0.23.0, < 0.23.5 | 0.21.110.22.40.23.5 |
| GHSA-6g7w-8wpp-frhj Denial of Service Vulnerability in Rustls Library |
High EPSS 0.95% |
No fix yet | |
| GHSA-6g7w-8wpp-frhj Denial of Service Vulnerability in Rustls Library |
High EPSS 0.95% |
>= 0.22.0, < 0.22.4 | 0.22.4 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor