Exposed TLS Secrets in rustls Package: Debug Implementations Vulnerability
Summary
RUSTSEC-2026-0346: Debug impls for client session values expose TLS secrets. Affects rustls versions >= 0.21.0, < 0.23.46. Fixed in 0.23.46. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rustls package is a modern TLS library for Rust, designed to provide secure communication over the internet. It is known for its performance and safety features, making it a popular choice for developers implementing TLS in their applications. However, a recent vulnerability has been identified in the Debug implementations of client session values, which could potentially expose sensitive TLS secrets.
Vulnerability Detail
The vulnerability arises from the Debug implementations of Tls12ClientSessionValue and Tls13ClientSessionValue, which inadvertently include the TLS 1.2 master secret or TLS 1.3 resumption PSK in their output. This means that if a custom ClientSessionStore implementation formats these values using Debug (for instance, during logging), it could lead to the unintentional disclosure of these secrets to anyone with access to the logs. This situation contradicts rustls's key-material redaction policy, which aims to protect sensitive information from being exposed in public APIs.
How To Fix
Latest published version: 0.23.46 as of 22 Oct 2026
The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the Debug implementation for logging client session values. Instead, implement custom logging that does not expose sensitive information. For example, you can create a custom struct that only logs non-sensitive fields.
Conclusion
The vulnerability in the rustls package highlights the importance of careful handling of sensitive information in logging practices. By updating to the patched version and implementing appropriate logging measures, developers can mitigate the risk of exposing TLS secrets.
See every vulnerability recorded for rustls →
FAQ
The CVSS score of this vulnerability is 4.0, indicating a moderate severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application's Cargo.lock file using the Vulert playground at Vulert Scanner without any signup.
Tls12ClientSessionValue and Tls13ClientSessionValue are structures used in the rustls library to manage client session information for TLS 1.2 and TLS 1.3 connections, respectively.
If you cannot update the rustls package immediately, ensure that you do not log sensitive session values using the Debug implementation, and consider implementing custom logging to avoid exposing secrets.
The key-material redaction policy in rustls is a guideline that aims to prevent sensitive information, such as TLS secrets, from being exposed in public APIs or logs.
References
Related vulnerabilities
Recent vulnerabilities recorded for rustls.
