CVE-2026-123613

The Rustls library versions 0.23.13 through 0.23.44 are vulnerable to a TLS 1.3 Handshake Encryption Level Bypass . The root cause is that the Deframer::aligned component fails to enforce RFC 8446 record-boundary alignment . This allow a peer or on-path attacker to pack a plaintext EncryptedExten...

EUVD-2026-119372

Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the same record, because Deframer::aligned does not enforce RFC 8446 record-boundary alignment. A peer or on-path attacker can pack a plaintext...

CVE-2026-123613 Rustls 0.23.13 before 0.23.45 TLS 1.3 Handshake Encryption Level Bypass

Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the same record, because Deframer::aligned does not enforce RFC 8446 record-boundary alignment. A peer or on-path attacker can pack a plaintext...

PT-2026-139894

Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the same record, because Deframer::aligned does not enforce RFC 8446 record-boundary alignment. A peer or on-path attacker can pack a plaintext...

CVE-2026-123613: rustls: Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a…

Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the same record, because Deframer::aligned does not enforce RFC 8446 record-boundary alignment. A peer or on-path attacker can pack a plaintext...