CVE-2026-123613— Rustls 0.23.13 before 0.23.45 TLS 1.3 Handshake Encryption Level Bypass

Quick assessment

Affected

rustls rustls

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在版本 0.23.13 至 0.23.45（不含）的 rustls 中，由于未强制实施 RFC 8446 规定的记录边界对齐，导致在同一个记录中紧跟密钥变更消息之后，TLS 1.3 握手消息被错误地以不正确的加密层级处理。这使得对等方或中间攻击者能够将明文与打包在一起，而 rustls 会将其作为未加密数据接受。

CVSS 5.3 · Medium Updated Nov 08, 2026

Possible ATT&CK Techniques 1 AI

T1573 · Encrypted Channel

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Rustls 0.23.13 before 0.23.45 TLS 1.3 Handshake Encryption Level Bypass

Source: CVE Program / CVE List V5

Vulnerability Description

Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the same record, because Deframer::aligned does not enforce RFC 8446 record-boundary alignment. A peer or on-path attacker can pack a plaintext EncryptedExtensions with the ServerHello, which rustls accepts unencrypted.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

输入验证不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
rustls	rustls	0.23.13 ~ 0.23.45	-

II. Public POCs for CVE-2026-123613

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123613

请登录查看更多情报信息。

Other References for CVE-2026-123613 (3)

https://github.com/rustls/rustls/commit/5046bdf8a612b35a2c1a9e168054c1d5c65e7dd7 patch
https://github.com/rustls/rustls/security/advisories/GHSA-2mjx-qc3c-rqvc vendor-advisory
https://www.vulncheck.com/advisories/rustls-0.23.13-before-0.23.45-tls-1.3-handshake-encryption-level-bypass third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-123613

Same Patch Batch · rustls · 2026-11-08 · 5 CVEs total

CVE-2026-123609	4.0 MEDIUM	Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 Secret Exposure via Debug
CVE-2026-123610	3.7 LOW	rustls before 0.23.46 Denial of Service via Brotli Certificate Decompression
CVE-2026-123611	3.7 LOW	rustls before 0.23.46 Key Exchange Downgrade via Unauthenticated ServerHello
CVE-2026-123612	2.3 LOW	rustls 0.23.44 and 0.23.45 ECH Rejection Application Data Disclosure

IV. Related Vulnerabilities

Same product: rustls

Same vendor: rustls

Same weakness: CWE-20