rustls vulnerabilities
Every vulnerability this feed holds for rustls, merged from five public registers and ordered by what warrants attention first — exploited in the wild, then CVSS, then recency.
5 vulnerabilities tracked.
- 6.9 Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message…
- 6.3 rustls before 0.23.46 contains a key exchange downgrade vulnerability that allows network attackers to poison the per-server-name…
- 6.3 rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits…
- 4.6 rustls 0.23.44 and 0.23.45 contain an information disclosure vulnerability that sends application data buffered before the handshake…
- 4.1 Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting…
What this covers
This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that rustls is free of vulnerabilities.
Query this from an agent over MCP · Check a lockfile by version
Other vendors tracked here
Linux Red Hat Google Microsoft Apple IBM Apache Software Foundation zephyrproject n/a Oracle Corporation Unknown JetBrains Drupal Cisco Tanium go-vikunja Eclipse Foundation hickory-dns Samsung Semiconductor SuiteCRM wazuh HCL Software Gnome vercel