CVE-2026-123612
LOW
NVD
CVSS Score
2.3
Severity
LOW
Published
Nov 08, 2026
Vendor
unknown
Description
rustls 0.23.44 and 0.23.45 contain an information disclosure vulnerability that sends application data buffered before the handshake completes to the client-facing server when Encrypted Client Hello is rejected. Because start_traffic() queues plaintext from ClientConnection::writer() before sending the ech_required alert, the authenticated public_name server receives data intended for the inner server.