---
id: RUSTSEC-2026-0285
aliases:
  - GHSA-2mjx-qc3c-rqvc
title: >-
  TLS 1.3 handshake messages incorrectly accepted across encryption level
  boundaries
summary: >-
  TLS 1.3 handshake messages incorrectly accepted across encryption level
  boundaries
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
vendor: rustls
product: rustls
ecosystem: rust
affected:
  - 'rustls >= 0.23.13, < 0.23.45'
patched:
  - rustls 0.23.45
published: '2026-09-14'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T18:00:10.944958251Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0285'
references:
  - url: 'https://crates.io/crates/rustls'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0285.html'
  - url: 'https://github.com/rustls/rustls/pull/3265'
tags:
  - osv
  - rust
ingestedAt: '2026-10-13T11:45:30.198Z'
---

## Overview

Rustls accepted TLS 1.3 handshake messages sent at the wrong encryption level
when they followed a key-changing message in the same record. For example,
a plaintext `EncryptedExtensions` message packed into the same record as the
`ServerHello` was accepted.

RFC 8446 section 5.1 requires that handshake messages do not span key changes,
and that implementations terminate the connection with an "unexpected_message"
alert if they do.

The handshake transcript is still authenticated, so a network-position attacker
cannot use this to alter or complete a handshake; the practical effect is that
a peer could send handshake messages that should be encrypted in plaintext
without rustls rejecting the connection.

This is functionally the same bug as Go's
[GO-2026-4340](https://pkg.go.dev/vuln/GO-2026-4340) (CVE-2025-61730).

## Affected packages

- `rustls >= 0.23.13, < 0.23.45`

## Remediation

Upgrade to a patched release:

- `rustls 0.23.45`