rustls has 15 CVEs on record between 2024 and 2026. Disclosure cadence is accelerating: 14 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 9. The median CVSS is 3.7 (low). None have a confirmed exploitation report. The most common weakness class is CWE-295 (3). Most affected products: rustls (11), webpki (4).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 3.7
- Publish → KEV
- —
- Last 90 days
- 14 prev 0
Weakness classes
Products
- rustls 11
- webpki 4
Worst active — by depth score
CVE-2026-93599High· 7.5rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs53CVE-2024-32650High· 7.5`rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input41GHSA-2mjx-qc3c-rqvcMedium· 5.3Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries29RUSTSEC-2026-0285Medium· 5.3TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries29CVE-2026-93602Medium· 4.4rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints24
rustls vulnerabilities
CVEs affecting rustls, newest first. Open any entry for full detail, references, and exploit status.
15 CVEsRSS
GHSA-h2v8-394m-p7vvLow· 3.7Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.
Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.
GHSA-c8m5-c952-6cm4Medium· 4.0Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs
Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs
GHSA-w44r-93j7-qv28Low· 3.7rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share
rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share
GHSA-vp88-798v-h67fLow· 2.3rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert
rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert
RUSTSEC-2026-0349Low· 3.7Unauthenticated ServerHello can downgrade later connections to classical key exchange
Unauthenticated ServerHello can downgrade later connections to classical key exchange
RUSTSEC-2026-0348Low· 3.7Brotli certificate decompression can allocate up to 1 GiB before authentication
Brotli certificate decompression can allocate up to 1 GiB before authentication
RUSTSEC-2026-0347Low· 2.3Buffered application data sent to outer server after ECH rejection
Buffered application data sent to outer server after ECH rejection
RUSTSEC-2026-0346Medium· 4.0`Debug` impls for client session values expose TLS secrets
`Debug` impls for client session values expose TLS secrets
GHSA-2mjx-qc3c-rqvcMedium· 5.3Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries
Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries
CVE-2026-93601Low· 2.2rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name
rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name…
CVE-2026-93599High· 7.5PoCrustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs
rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly [0x00] (ze…
CVE-2026-93602Medium· 4.4rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints
rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints. At…
CVE-2026-93600Low· 2.2rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced
rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Becaus…
RUSTSEC-2026-0285Medium· 5.3TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries
TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries
CVE-2024-32650High· 7.5`rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input
`rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input