Debian Rust Security Tracker 🩺🦀

RUSTSEC-2026-0346: `Debug` impls for client session values expose TLS secrets

medium 45 affected
Crate
rustls
Patched Versions
>=0.23.46
Debian Version
0.23.45+ds-1
0.21.12-15
Debian Bugs
—
Issued
2026-10-14
Aliases
GHSA-c8m5-c952-6cm4
Patched:Affected

The Debug implementations of Tls12ClientSessionValue and Tls13ClientSessionValue were derived, and so included the TLS 1.2 master secret or TLS 1.3 resumption PSK in their output.

Custom ClientSessionStore implementations that format these values with Debug (for example, when logging) could disclose these secrets to readers of the logs. This conflicts with rustls's key-material redaction policy.

Ordinary connection and built-in session cache Debug output is redacted and is not affected.

Affected Packages

rustls 0.23.45 acme-redirect 0.8.1+dfsg-3+b3
rustls 0.23.45 apt-swarm 0.6.0-2+b3
rustls 0.23.45 apt-transport-blob 1.2.2-1+b2
rustls 0.23.45 bmap-rs 0.2.3-1
rustls 0.23.45 cargo-audit 0.22.2-1+b3
rustls 0.23.45 css-inline 0.22.0-1
rustls 0.23.45 debian-lsp 0.1.8-5+b2
rustls 0.23.45 debian-repro-status 0.4.0-3
rustls 0.23.45 gpg-sq 0.13.1-14+b2
rustls 0.23.45 gpgv-sq 0.13.1-14+b2
rustls 0.23.45 hickory-dns 0.26.3-1+b2
rustls 0.23.45 hussh 0.2.3-1
rustls 0.23.45 hypothesis-client 0.12.0-4+b3
rustls 0.23.45 icu4x-datagen 2.2.0-1+b2
affected ⚠️ librust-rustls-0.21-dev 0.21.12-15
affected ⚠️ librust-rustls-dev 0.23.45+ds-1
rustls 0.23.45 miniserve 0.35.0-5+b2
rustls 0.23.45 nethsm-pkcs11 2.0.0-3+b2
rustls 0.23.45 ntpd-rs 1.9.0-1+b2
rustls 0.23.45 ntpd-rs-metrics 1.9.0-1+b2
rustls 0.23.45 numbat 1.24.0-1
rustls 0.23.45 ognibuild 0.2.19-2+b2
rustls 0.23.45 patch-hub 0.1.7-3+b2
rustls 0.23.45 protonup-rs 0.15.0-1+b2
rustls 0.23.45 prr 0.21.0-2+b2
rustls 0.23.45 python3-taskchampion-py 2.0.2-5+b2
rustls 0.23.45 rbw 1.15.0-2+b2
rustls 0.23.45 rebuildctl 0.28.0-1+b2
rustls 0.23.45 rebuilderd 0.28.0+ds-2+b2
rustls 0.23.45 rebuilderd-worker 0.28.0-1+b2
rustls 0.23.45 repro-env 0.4.4+dfsg-3+b3
rustls 0.23.45 repro-threshold 0.1.2-1+b2
rustls 0.23.45 ripasso-cursive 0.8.0-1+b7
rustls 0.23.45 safe-vdash 0.20.0-6+b2
rustls 0.23.45 samply 0.13.1-1+b2
rustls 0.23.45 sccache 0.17.0+ds-3+b2
rustls 0.23.45 sequoia-git 0.6.0-2+b2
rustls 0.23.45 signal-tlsd 0.1.4-1+b2
rustls 0.23.45 silver-platter 0.8.4-2+b3
rustls 0.23.45 spytrap-adb 0.3.5-5+b2
rustls 0.23.45 sq 1.4.1-1
rustls 0.23.45 taskwarrior 3.5.0+dfsg-3+b2
rustls 0.23.45 tealdeer 1.9.0-1+b2
rustls 0.23.45 wasm-pack 0.15.0+ds-2+b2
rustls 0.23.45 xh 0.26.2-1+b2