Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

RUSTSEC-2026-0346: `Debug` impls for client session values expose TLS secrets

Open
  • Is something wrong?
#29 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
55/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
rust
Domain
security

Research direction

The vulnerable package is rustls 0.23.40, and the advisory says patched versions are >=0.23.46. Start by checking which crate pulls it in with cargo tree -i rustls, then update the lock with cargo update -p rustls (or edit the constraint in Cargo.toml if it is pinned). Done when Cargo.lock resolves to a patched rustls, cargo build and the test suite pass, and cargo audit no longer reports RUSTSEC-2026-0346.

Written by the indexing model from the issue text.

Description

Debug impls for client session values expose TLS secrets

Details
Package rustls
Version 0.23.40
URL https://github.com/rustls/rustls/pull/3299
Date 2026-10-14
Patched versions >=0.23.46
Unaffected versions <0.21.0

The Debug implementations of Tls12ClientSessionValue and
Tls13ClientSessionValue were derived, and so included the TLS 1.2 master
secret or TLS 1.3 resumption PSK in their output.

Custom ClientSessionStore implementations that format these values with
Debug (for example, when logging) could disclose these secrets to readers of
the logs. This conflicts with rustls's
key-material redaction policy.

Ordinary connection and built-in session cache Debug output is redacted and
is not affected.

See advisory page for additional details.

Dominant language
Rust
Stars
0
Forks
2
No merged PRs in 30d

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from stackabletech/postgresql-trino-gateway

All issues in stackabletech/postgresql-trino-gateway

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.