---
id: RUSTSEC-2026-0346
aliases:
  - GHSA-c8m5-c952-6cm4
title: '`Debug` impls for client session values expose TLS secrets'
summary: '`Debug` impls for client session values expose TLS secrets'
severity: medium
cvss: 4
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N'
vendor: rustls
product: rustls
ecosystem: rust
affected:
  - 'rustls >= 0.21.0, < 0.23.46'
patched:
  - rustls 0.23.46
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:30:02.480694744Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0346'
references:
  - url: 'https://crates.io/crates/rustls'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0346.html'
  - url: 'https://github.com/rustls/rustls/pull/3299'
tags:
  - osv
  - rust
ingestedAt: '2026-10-15T11:47:08.229Z'
---

## Overview

The `Debug` implementations of `Tls12ClientSessionValue` and
`Tls13ClientSessionValue` were derived, and so included the TLS 1.2 master
secret or TLS 1.3 resumption PSK in their output.

Custom `ClientSessionStore` implementations that format these values with
`Debug` (for example, when logging) could disclose these secrets to readers of
the logs. This conflicts with rustls's
[key-material redaction policy](https://github.com/rustls/rustls/blob/99f2358cae2954837dbb866faf6727de75489ab9/SECURITY.md#boundary-public-api).

Ordinary connection and built-in session cache `Debug` output is redacted and
is not affected.

## Affected packages

- `rustls >= 0.21.0, < 0.23.46`

## Remediation

Upgrade to a patched release:

- `rustls 0.23.46`