{"aliases":["GHSA-c8m5-c952-6cm4"],"categories":["crypto-failure"],"crate":"rustls","cves":[],"cvss":0.0,"database_specific":{"severity":"medium"},"date":"2026-10-14","deb_packages":[{"crate_name":"acme-redirect","deb_name":"acme-redirect","version":"0.8.1+ds-1"},{"crate_name":"apt-swarm","deb_name":"apt-swarm","version":"0.6.0-3"},{"crate_name":"apt-transport-blob","deb_name":"apt-transport-blob","version":"1.2.2-1+b2"},{"crate_name":"bmap-rs","deb_name":"bmap-rs","version":"0.2.3-1"},{"crate_name":"cargo-audit","deb_name":"cargo-audit","version":"0.22.2-1+b3"},{"crate_name":"css-inline","deb_name":"css-inline","version":"0.22.0-1"},{"crate_name":"debian-lsp","deb_name":"debian-lsp","version":"0.1.8-5+b2"},{"crate_name":"debian-repro-status","deb_name":"debian-repro-status","version":"0.4.0-3"},{"crate_name":"sequoia-chameleon-gnupg","deb_name":"gpg-sq","version":"0.13.1-15"},{"crate_name":"sequoia-chameleon-gnupg","deb_name":"gpgv-sq","version":"0.13.1-15"},{"crate_name":"hickory-dns","deb_name":"hickory-dns","version":"0.26.3-1+b2"},{"crate_name":"hussh","deb_name":"hussh","version":"0.2.3-1"},{"crate_name":"hypothesis","deb_name":"hypothesis-client","version":"0.12.0-4+b3"},{"crate_name":"icu4x-datagen","deb_name":"icu4x-datagen","version":"2.2.0-1+b2"},{"crate_name":"rustls","deb_name":"librust-rustls-0.21-dev","version":"0.21.12-15"},{"crate_name":"miniserve","deb_name":"miniserve","version":"0.35.0-6"},{"crate_name":null,"deb_name":"nethsm-pkcs11","version":"2.0.0-3+b2"},{"crate_name":"ntpd","deb_name":"ntpd-rs","version":"1.9.0-1+b2"},{"crate_name":"ntpd","deb_name":"ntpd-rs-metrics","version":"1.9.0-1+b2"},{"crate_name":"numbat-cli","deb_name":"numbat","version":"1.24.0-1"},{"crate_name":"ognibuild","deb_name":"ognibuild","version":"0.2.21-1"},{"crate_name":null,"deb_name":"patch-hub","version":"0.1.7-3+b2"},{"crate_name":"protonup-rs","deb_name":"protonup-rs","version":"0.15.0-1+b2"},{"crate_name":"prr","deb_name":"prr","version":"0.21.0-2+b2"},{"crate_name":"rbw","deb_name":"rbw","version":"1.15.0-2+b2"},{"crate_name":"rebuildctl","deb_name":"rebuildctl","version":"0.28.0-2"},{"crate_name":"rebuilderd","deb_name":"rebuilderd","version":"0.28.0+ds-2+b2"},{"crate_name":"rebuilderd-worker","deb_name":"rebuilderd-worker","version":"0.28.0-1+b2"},{"crate_name":"repro-env","deb_name":"repro-env","version":"0.4.4+ds-1"},{"crate_name":"repro-threshold","deb_name":"repro-threshold","version":"0.1.2-1+b2"},{"crate_name":"ripasso-cursive","deb_name":"ripasso-cursive","version":"0.8.0-1+b7"},{"crate_name":null,"deb_name":"safe-vdash","version":"0.20.0-6+b2"},{"crate_name":"samply","deb_name":"samply","version":"0.13.1-1+b2"},{"crate_name":"sequoia-git","deb_name":"sequoia-git","version":"0.6.0-2+b2"},{"crate_name":"signal-tlsd","deb_name":"signal-tlsd","version":"0.1.4-1+b2"},{"crate_name":"silver-platter","deb_name":"silver-platter","version":"0.8.4-2+b3"},{"crate_name":"spytrap-adb","deb_name":"spytrap-adb","version":"0.3.5-6"},{"crate_name":"sequoia-sq","deb_name":"sq","version":"1.4.1-2"},{"crate_name":null,"deb_name":"taskwarrior","version":"3.5.0+dfsg-3+b2"},{"crate_name":"tealdeer","deb_name":"tealdeer","version":"1.9.0-2"},{"crate_name":"xh","deb_name":"xh","version":"0.26.3-1"}],"description":"The `Debug` implementations of `Tls12ClientSessionValue` and\n`Tls13ClientSessionValue` were derived, and so included the TLS 1.2 master\nsecret or TLS 1.3 resumption PSK in their output.\n\nCustom `ClientSessionStore` implementations that format these values with\n`Debug` (for example, when logging) could disclose these secrets to readers of\nthe logs. This conflicts with rustls's\n[key-material redaction policy](https://github.com/rustls/rustls/blob/99f2358cae2954837dbb866faf6727de75489ab9/SECURITY.md#boundary-public-api).\n\nOrdinary connection and built-in session cache `Debug` output is redacted and\nis not affected.","id":"RUSTSEC-2026-0346","keywords":[],"patched_versions":[">=0.23.46"],"source":"debian_rustsec","title":"`Debug` impls for client session values expose TLS secrets","url":"https://github.com/rustls/rustls/pull/3299"}