Sensitive Data Exposure in rustls: Buffered Application Data Sent to Outer Server After ECH Rejection
Summary
RUSTSEC-2026-0347: Buffered application data sent to outer server after ECH rejection. Affects rustls versions >= 0.23.44, < 0.23.46. Fixed in 0.23.46. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rustls is a modern TLS library written in Rust, designed to provide secure communication over the internet. It emphasizes safety and performance, making it a popular choice for developers looking to implement TLS in their applications. However, a recent vulnerability has been identified that affects clients using the Encrypted Client Hello (ECH) feature, specifically when the server rejects the ECH configuration.
Vulnerability Detail
The vulnerability arises when a server rejects an Encrypted Client Hello (ECH) request. In this scenario, the client completes the handshake using the outer ClientHello and authenticates the server against the ECH config's public_name. After this handshake, any application data buffered before the ech_required alert is sent is mistakenly transmitted to the client-facing server. This behavior violates RFC 9849 section 6.1.6, which mandates that the client must abort with ech_required before sending any application data. Although the server is authenticated, this could lead to unintended data exposure, especially if sensitive information is sent before the handshake is properly completed.
How To Fix
Latest published version: 0.23.46 as of 22 Oct 2026
The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid sending any application data before the handshake is fully completed. Ensure that your application logic adheres to the proper sequence of operations when using ECH.
Conclusion
In summary, the rustls library has a vulnerability that can lead to the exposure of sensitive application data when ECH is rejected by the server. It is crucial for developers using rustls to update to the latest version to mitigate this risk. Additionally, following best practices in application data handling can further enhance security.
See every vulnerability recorded for rustls →
FAQ
The vulnerability can lead to sensitive application data being sent to the wrong server, potentially exposing it to unauthorized parties.
Clients using rustls with ECH enabled, who send application data before the handshake completes, and connect to servers that reject their ECH configuration.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 2.3, indicating a low severity level.
Yes, updating to rustls version 0.23.46 or later will permanently fix the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for rustls.
