RUSTSEC-2026-0285: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 68/100
Research direction
Search the repository's dependency manifests and lockfile for rustls 0.23.36, then review how the dependency is selected. Update it to a patched version at least 0.23.45, run the existing test suite, and confirm the resolved dependency no longer matches the affected version.
Written by the indexing model from the issue text.
Description
TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries
| Details | |
|---|---|
| Package | rustls |
| Version | 0.23.36 |
| URL | https://github.com/rustls/rustls/security/advisories/GHSA-2mjx-qc3c-rqvc |
| Date | 2026-09-14 |
| Patched versions | >=0.23.45 |
| Unaffected versions | <0.23.13 |
Rustls accepted TLS 1.3 handshake messages sent at the wrong encryption level
when they followed a key-changing message in the same record. For example,
a plaintext EncryptedExtensions message packed into the same record as the
ServerHello was accepted.
RFC 8446 section 5.1 requires that handshake messages do not span key changes,
and that implementations terminate the connection with an "unexpected_message"
alert if they do.
The handshake transcript is still authenticated, so a network-position attacker
cannot use this to alter or complete a handshake; the practical effect is that
a peer could send handshake messages that should be encrypted in plaintext
without rustls rejecting the connection.
This is functionally the same bug as Go's
GO-2026-4340 (CVE-2025-61730).
See advisory page for additional details.
- Dominant language
- Rust
- Stars
- 2.7k
- Forks
- 162
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 7
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from aws/aws-lambda-web-adapter
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
aws/aws-lambda-web-adapter#828 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
aws/aws-lambda-web-adapter#788 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 58/100
aws/aws-lambda-web-adapter#830 · 2 comments ·
-
RUSTSEC-2026-0221: `event-listener` allows `!Send` tags to cross thread boundaries via `StackSlot` Open
Difficulty 3/5 1-2 days Newbie friendliness 25/100
aws/aws-lambda-web-adapter#814 ·
-
enhancement good first issue
Difficulty 4/5 3-5 days Newbie friendliness 52/100
aws/aws-lambda-web-adapter#789 · 1 comment ·
All issues in aws/aws-lambda-web-adapter
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Eynzof/Hermes-CN-Desktop#610 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
gitbutlerapp/gitbutler#15998 · 1 comment ·
-
bug triage:deciding
Difficulty 1/5 Under an hour Newbie friendliness 88/100
open-telemetry/otel-arrow#4132 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100