CVE-2026-123612 | BDVDB-2026-401969 Detail

Description#

rustls 0.23.44 and 0.23.45 contain an information disclosure vulnerability that sends application data buffered before the handshake completes to the client-facing server when Encrypted Client Hello is rejected. Because start_traffic() queues plaintext from ClientConnection::writer() before sending the ech_required alert, the authenticated public_name server receives data intended for the inner server.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-11-08Record published in the CVE List.