{"id":"RUSTSEC-2026-0285","aliases":["GHSA-2mjx-qc3c-rqvc"],"title":"TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries","summary":"TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","vendor":"rustls","product":"rustls","ecosystem":"rust","affected":["rustls >= 0.23.13, < 0.23.45"],"patched":["rustls 0.23.45"],"published":"2026-09-14","updated":"2026-10-12","sourceUpdated":"2026-10-12T18:00:10.944958251Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0285","references":[{"url":"https://crates.io/crates/rustls"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0285.html"},{"url":"https://github.com/rustls/rustls/pull/3265"}],"tags":["osv","rust"],"ingestedAt":"2026-10-13T11:45:30.198Z","slug":"RUSTSEC-2026-0285","body":"## Overview\n\nRustls accepted TLS 1.3 handshake messages sent at the wrong encryption level\nwhen they followed a key-changing message in the same record. For example,\na plaintext `EncryptedExtensions` message packed into the same record as the\n`ServerHello` was accepted.\n\nRFC 8446 section 5.1 requires that handshake messages do not span key changes,\nand that implementations terminate the connection with an \"unexpected_message\"\nalert if they do.\n\nThe handshake transcript is still authenticated, so a network-position attacker\ncannot use this to alter or complete a handshake; the practical effect is that\na peer could send handshake messages that should be encrypted in plaintext\nwithout rustls rejecting the connection.\n\nThis is functionally the same bug as Go's\n[GO-2026-4340](https://pkg.go.dev/vuln/GO-2026-4340) (CVE-2025-61730).\n\n## Affected packages\n\n- `rustls >= 0.23.13, < 0.23.45`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `rustls 0.23.45`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}