While the Rustls modern TLS library is written in the Rust programming language with a focus on memory safety, as we've seen out of other Rust project re-implementations in the past, the new implementations can lead to other security bugs of their own. Out today is Rustls 0.23.45 to fix a security issue introduced back in 2024 with Rustls while the likes of OpenSSL, BoringSSL, and others are unaffected.

Rustls 0.23.45 was released in order to fix a bug where TLS 1.3 handshake messages were incorrectly accepted across encryption level boundaries. The now-public [1]advisory notes that this incorrect handling of TLS 1.3 handshake messages across encryption level boundaries could lead an on-path attacker to injecting plain text messages that are then accepted by Rustls. Ultimately it comes down to Rustls' implementation of TLS 1.3 having been out-of-spec compared to RFC 8446.

Today's Rustls 0.23.45 [2]announcement adds:

"Rustls accepted TLS 1.3 handshake messages sent at the wrong encryption level when they followed a key-changing message in the same record. The handshake transcript is still authenticated, so a network-position attacker cannot use this to alter or complete a handshake; the practical effect is that a peer could send handshake messages that should be encrypted in plaintext without rustls rejecting the connection."

The issue is similar to [3]this Go vulnerability from January.

The issue was [4]fixed in the Rustls code yesterday and now available via v0.23.45. The issue has been present in Rustls since v0.23.13 released back in September 2024.



[1] https://github.com/rustls/rustls/security/advisories/GHSA-2mjx-qc3c-rqvc

[2] https://github.com/rustls/rustls/releases/tag/v%2F0.23.45

[3] https://pkg.go.dev/vuln/GO-2026-4340

[4] https://github.com/rustls/rustls/pull/3265