This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-123613 | BDVDB-2026-401970 Detail

rustlsrustls

Description#

Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the same record, because Deframer::aligned does not enforce RFC 8446 record-boundary alignment. A peer or on-path attacker can pack a plaintext EncryptedExtensions with the ServerHello, which rustls accepts unencrypted.

Impact#

Per CVSS v3.1: confidentiality impact low, integrity impact none, availability impact none. Attack vector: network.

Weaknesses#

  • CWE-20 Improper Input Validation

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.