CVE-2026-123609

Name	CVE-2026-123609
Description	Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1151104

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
rust-rustls (PTS)	bookworm	0.20.8-4	vulnerable
	trixie	0.23.26+ds-1	vulnerable
	forky	0.23.45+ds-1	vulnerable
	sid	0.23.46+ds-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
rust-rustls	source	(unstable)	0.23.46+ds-1			1151104

https://rustsec.org/advisories/RUSTSEC-2026-0346.html
https://github.com/advisories/GHSA-c8m5-c952-6cm4
https://github.com/rustls/rustls/pull/3299