Bug 2568765 (CVE-2026-123609) - CVE-2026-123609 rustls: rustls: Information disclosure via debug formatting of client session values
Summary: CVE-2026-123609 rustls: rustls: Information disclosure via debug formatting o...
Keywords:
Status: NEW
Alias: CVE-2026-123609
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-11-08 02:02 UTC by OSIDB Bzimport
Modified: 2026-11-08 02:55 UTC (History)
75 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-11-08 02:02:08 UTC 
Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.
Note You need to log in before you can comment on or make changes to this bug.