{"items":[{"id":"NVI-00010732","kind":"vulnerability","title":"Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-2mjx-qc3c-rqvc"],"plain_summary":"GitHub lists this reviewed advisory for rustls. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-d6511b17bc44f83b4c7aa344e0b3e9be"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-27T15:14:39.000Z","value":"5.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-d6511b17bc44f83b4c7aa344e0b3e9be"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-d6511b17bc44f83b4c7aa344e0b3e9be","url":"https://github.com/advisories/GHSA-2mjx-qc3c-rqvc","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-2mjx-qc3c-rqvc","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:06:46.371Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-d6511b17bc44f83b4c7aa344e0b3e9be"],"technology":"rustls","known_exclusions":[],"conditions_summary":"Rustls accepted TLS 1.3 handshake messages sent at the wrong encryption level when they followed a key-changing message in the same record. The handshake transcript is still authenticated, so a network-position attacker cannot use this to alter or complete a handshake; the practical effect is that a peer could send handshake messages that should be encrypted in plaintext without rustls rejecting the connection.\n\nThis issue affects rustls versions 0.23.13 through 0.23.44 inclusive.\n\n# Original report\n### Summary\nRustls (tested version 0.23.44, and it appears still an issue on latest master though I have not tested this) accepts a TLS 1.3 server flight where a plaintext EncryptedExtensions is packed into the same record as the ServerHello.\n\nThis is very similar to Go's CVE-2025-61730 fixed in https://github.com/golang/go/commit/5046bdf8a612b35a2c1a9e168054c1d5c65e7dd7\n\n### Details\nIt appears `Deframer::aligned` considers itself aligned as long as all messages remaining in the buffer are complete. Rustls processes the ServerHello, installs the handshake keys, then pulls the complete (plaintext) EncryptedExtensions out of the buffer.\n\nThis is insufficient per RFC 8446 section 5.1's\n\n> ","public_affected_ranges":[">= 0.23.13, < 0.23.45"]}],"null_published_at":"2026-10-31T22:27:12.378Z","source_updated_at":"2026-10-27T15:14:39.000Z","source_disclosed_at":"2026-10-05T23:30:17.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T22:06:46.371Z"}],"next_cursor":null,"snapshot_revision":"42594"}