CVE-2026-123612— rustls 0.23.44 and 0.23.45 ECH Rejection Application Data Disclosure

Quick assessment

Affected

rustls rustls

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

rustls 0.23.44 和 0.23.45 版本中存在一个信息泄露漏洞：当加密客户端问候（Encrypted Client Hello, ECH）被拒绝时，该漏洞会将握手完成前已缓冲的应用数据发送给面向客户端的服务器。由于在发送警报之前，已将来自的明文数据加入队列，导致经过身份验证的服务器接收到了本应发送给内部服务器的数据。

CVSS 2.3 · Low Updated Nov 08, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

rustls 0.23.44 and 0.23.45 ECH Rejection Application Data Disclosure

Source: CVE Program / CVE List V5

Vulnerability Description

rustls 0.23.44 and 0.23.45 contain an information disclosure vulnerability that sends application data buffered before the handshake completes to the client-facing server when Encrypted Client Hello is rejected. Because start_traffic() queues plaintext from ClientConnection::writer() before sending the ech_required alert, the authenticated public_name server receives data intended for the inner server.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

不正确的行为次序

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
rustls	rustls	0.23.44 ~ 0.23.46	-

II. Public POCs for CVE-2026-123612

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123612

请登录查看更多情报信息。

Other References for CVE-2026-123612 (2)

https://github.com/rustls/rustls/security/advisories/GHSA-vp88-798v-h67f vendor-advisory
https://www.vulncheck.com/advisories/rustls-0.23.44-and-0.23.45-ech-rejection-application-data-disclosure third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-123612

Same Patch Batch · rustls · 2026-11-08 · 5 CVEs total

CVE-2026-123613	5.3 MEDIUM	Rustls 0.23.13 before 0.23.45 TLS 1.3 Handshake Encryption Level Bypass
CVE-2026-123609	4.0 MEDIUM	Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 Secret Exposure via Debug
CVE-2026-123610	3.7 LOW	rustls before 0.23.46 Denial of Service via Brotli Certificate Decompression
CVE-2026-123611	3.7 LOW	rustls before 0.23.46 Key Exchange Downgrade via Unauthenticated ServerHello

IV. Related Vulnerabilities

Same product: rustls

Same vendor: rustls

Same weakness: CWE-696