CVE WATCH / VULNERABILITY DETAIL
CVE-2026-123613
MEDIUMCVSS 5.3NVD feed
Published 8 November 2026 · tracked since 8 November 2026
Description
Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the same record, because Deframer::aligned does not enforce RFC 8446 record-boundary alignment. A peer or on-path attacker can pack a plaintext EncryptedExte
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog