rustsec-2026-0346

{
  "aliases": [
    "GHSA-c8m5-c952-6cm4"
  ],
  "categories": [
    "crypto-failure"
  ],
  "crate": "rustls",
  "cves": [],
  "cvss": 0.0,
  "database_specific": {
    "severity": "medium"
  },
  "date": "2026-10-14",
  "deb_packages": [
    {
      "crate_name": "acme-redirect",
      "deb_name": "acme-redirect",
      "version": "0.8.1+ds-1"
    },
    {
      "crate_name": "apt-swarm",
      "deb_name": "apt-swarm",
      "version": "0.6.0-3"
    },
    {
      "crate_name": "apt-transport-blob",
      "deb_name": "apt-transport-blob",
      "version": "1.2.2-1+b2"
    },
    {
      "crate_name": "bmap-rs",
      "deb_name": "bmap-rs",
      "version": "0.2.3-1"
    },
    {
      "crate_name": "cargo-audit",
      "deb_name": "cargo-audit",
      "version": "0.22.2-1+b3"
    },
    {
      "crate_name": "css-inline",
      "deb_name": "css-inline",
      "version": "0.22.0-1"
    },
    {
      "crate_name": "debian-lsp",
      "deb_name": "debian-lsp",
      "version": "0.1.8-5+b2"
    },
    {
      "crate_name": "debian-repro-status",
      "deb_name": "debian-repro-status",
      "version": "0.4.0-3"
    },
    {
      "crate_name": "sequoia-chameleon-gnupg",
      "deb_name": "gpg-sq",
      "version": "0.13.1-15"
    },
    {
      "crate_name": "sequoia-chameleon-gnupg",
      "deb_name": "gpgv-sq",
      "version": "0.13.1-15"
    },
    {
      "crate_name": "hickory-dns",
      "deb_name": "hickory-dns",
      "version": "0.26.3-1+b2"
    },
    {
      "crate_name": "hussh",
      "deb_name": "hussh",
      "version": "0.2.3-1"
    },
    {
      "crate_name": "hypothesis",
      "deb_name": "hypothesis-client",
      "version": "0.12.0-4+b3"
    },
    {
      "crate_name": "icu4x-datagen",
      "deb_name": "icu4x-datagen",
      "version": "2.2.0-1+b2"
    },
    {
      "crate_name": "rustls",
      "deb_name": "librust-rustls-0.21-dev",
      "version": "0.21.12-15"
    },
    {
      "crate_name": "miniserve",
      "deb_name": "miniserve",
      "version": "0.35.0-6"
    },
    {
      "crate_name": null,
      "deb_name": "nethsm-pkcs11",
      "version": "2.0.0-3+b2"
    },
    {
      "crate_name": "ntpd",
      "deb_name": "ntpd-rs",
      "version": "1.9.0-1+b2"
    },
    {
      "crate_name": "ntpd",
      "deb_name": "ntpd-rs-metrics",
      "version": "1.9.0-1+b2"
    },
    {
      "crate_name": "numbat-cli",
      "deb_name": "numbat",
      "version": "1.24.0-1"
    },
    {
      "crate_name": "ognibuild",
      "deb_name": "ognibuild",
      "version": "0.2.21-1"
    },
    {
      "crate_name": null,
      "deb_name": "patch-hub",
      "version": "0.1.7-3+b2"
    },
    {
      "crate_name": "protonup-rs",
      "deb_name": "protonup-rs",
      "version": "0.15.0-1+b2"
    },
    {
      "crate_name": "prr",
      "deb_name": "prr",
      "version": "0.21.0-2+b2"
    },
    {
      "crate_name": "rbw",
      "deb_name": "rbw",
      "version": "1.15.0-2+b2"
    },
    {
      "crate_name": "rebuildctl",
      "deb_name": "rebuildctl",
      "version": "0.28.0-2"
    },
    {
      "crate_name": "rebuilderd",
      "deb_name": "rebuilderd",
      "version": "0.28.0+ds-2+b2"
    },
    {
      "crate_name": "rebuilderd-worker",
      "deb_name": "rebuilderd-worker",
      "version": "0.28.0-1+b2"
    },
    {
      "crate_name": "repro-env",
      "deb_name": "repro-env",
      "version": "0.4.4+ds-1"
    },
    {
      "crate_name": "repro-threshold",
      "deb_name": "repro-threshold",
      "version": "0.1.2-1+b2"
    },
    {
      "crate_name": "ripasso-cursive",
      "deb_name": "ripasso-cursive",
      "version": "0.8.0-1+b7"
    },
    {
      "crate_name": null,
      "deb_name": "safe-vdash",
      "version": "0.20.0-6+b2"
    },
    {
      "crate_name": "samply",
      "deb_name": "samply",
      "version": "0.13.1-1+b2"
    },
    {
      "crate_name": "sequoia-git",
      "deb_name": "sequoia-git",
      "version": "0.6.0-2+b2"
    },
    {
      "crate_name": "signal-tlsd",
      "deb_name": "signal-tlsd",
      "version": "0.1.4-1+b2"
    },
    {
      "crate_name": "silver-platter",
      "deb_name": "silver-platter",
      "version": "0.8.4-2+b3"
    },
    {
      "crate_name": "spytrap-adb",
      "deb_name": "spytrap-adb",
      "version": "0.3.5-6"
    },
    {
      "crate_name": "sequoia-sq",
      "deb_name": "sq",
      "version": "1.4.1-2"
    },
    {
      "crate_name": null,
      "deb_name": "taskwarrior",
      "version": "3.5.0+dfsg-3+b2"
    },
    {
      "crate_name": "tealdeer",
      "deb_name": "tealdeer",
      "version": "1.9.0-2"
    },
    {
      "crate_name": "xh",
      "deb_name": "xh",
      "version": "0.26.3-1"
    }
  ],
  "description": "The `Debug` implementations of `Tls12ClientSessionValue` and\n`Tls13ClientSessionValue` were derived, and so included the TLS 1.2 master\nsecret or TLS 1.3 resumption PSK in their output.\n\nCustom `ClientSessionStore` implementations that format these values with\n`Debug` (for example, when logging) could disclose these secrets to readers of\nthe logs. This conflicts with rustls's\n[key-material redaction policy](https://github.com/rustls/rustls/blob/99f2358cae2954837dbb866faf6727de75489ab9/SECURITY.md#boundary-public-api).\n\nOrdinary connection and built-in session cache `Debug` output is redacted and\nis not affected.",
  "id": "RUSTSEC-2026-0346",
  "keywords": [],
  "patched_versions": [
    ">=0.23.46"
  ],
  "source": "debian_rustsec",
  "title": "`Debug` impls for client session values expose TLS secrets",
  "url": "https://github.com/rustls/rustls/pull/3299"
}