RUSTSEC-2026-0285: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries

Open
#23 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
48/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
rust
Domain
security

Research direction

The issue identifies rustls 0.23.40 as affected and lists 0.23.45 as patched. First locate how this Rust repository declares its rustls dependency, then check the available project verification commands. Done means the affected version is no longer used and the existing checks pass.

Written by the indexing model from the issue text.

Description

TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries

Details
Package rustls
Version 0.23.40
URL https://github.com/rustls/rustls/security/advisories/GHSA-2mjx-qc3c-rqvc
Date 2026-09-14
Patched versions >=0.23.45
Unaffected versions <0.23.13

Rustls accepted TLS 1.3 handshake messages sent at the wrong encryption level
when they followed a key-changing message in the same record. For example,
a plaintext EncryptedExtensions message packed into the same record as the
ServerHello was accepted.

RFC 8446 section 5.1 requires that handshake messages do not span key changes,
and that implementations terminate the connection with an "unexpected_message"
alert if they do.

The handshake transcript is still authenticated, so a network-position attacker
cannot use this to alter or complete a handshake; the practical effect is that
a peer could send handshake messages that should be encrypted in plaintext
without rustls rejecting the connection.

This is functionally the same bug as Go's
GO-2026-4340 (CVE-2025-61730).

See advisory page for additional details.

Dominant language
Rust
Stars
0
Forks
2
Avg merge
3d 24m
Merged PRs (30d)
3

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from stackabletech/postgresql-trino-gateway

All issues in stackabletech/postgresql-trino-gateway

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.