Loading story…
Rustls has fixed a medium-severity TLS 1.3 protocol-handling flaw, tracked as RUSTSEC-2026-0285 and GHSA-2mjx-qc3c-rqvc, that accepted handshake messages crossing encryption-level boundaries if they followed a key-changing message in the same TLS record. This could allow, for example, an unencrypted EncryptedExtensions message to be accepted alongside ServerHello, contrary to RFC 8446 section 5.1.
The issue affects Rustls releases from 0.23.13 through versions before 0.23.45; versions earlier than 0.23.13 are unaffected. Rustls 0.23.45 remediates the defect. A network-position attacker cannot alter or complete the authenticated handshake because transcript authentication remains intact, but a peer could send handshake content in plaintext when it should have been encrypted without the connection being rejected. OpenSSL and BoringSSL are not affected; the flaw is functionally equivalent to Go advisory GO-2026-4340 / CVE-2025-61730.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Rustls released version 0.23.45 as the patched version and issued vulnerability advisory GHSA-2mjx-qc3c-rqvc, rated medium severity with CVSS 5.3. The issue is functionally equivalent to GO-2026-4340/CVE-2025-61730; versions before 0.23.13 are listed as unaffected.
Rustls fixed the TLS 1.3 protocol-handling issue in its source code. The flaw could permit plaintext handshake messages, such as EncryptedExtensions, to be accepted where encryption was required.
Rustls version 0.23.13 was released with logic that could accept TLS 1.3 handshake messages crossing encryption-level boundaries when following a key-changing message in the same TLS record.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Go disclosed **CVE-2025-61730** (`GO-2026-4340`), a flaw in the `crypto/tls` implementation's handling of TLS 1.3 handshake records. When multiple handshake messages cross encryption-level boundaries within TLS records, Go can process later messages before updating the active encryption level. A network-local attacker able to inject messages during a TLS handshake could exploit the condition to obtain minor information disclosure. Organizations using affected Go applications should upgrade to Go **1.24.12** or later, or **1.25.6** or later; releases before 1.24.12 and versions from 1.25.0 through 1.25.5 are affected.
Sep 14, 2026
Two high-severity vulnerabilities were disclosed in **rust-openssl**, the Rust bindings for OpenSSL, affecting multiple `0.9.x` and `0.10.x` releases prior to **`0.10.78`**. **`CVE-2026-41898`** affects versions from `0.9.24` up to, but not including, `0.10.78`, where several FFI trampoline callback paths passed a closure-returned `usize` to OpenSSL without validating it against the output buffer size. The flaw can trigger buffer overflows and leak adjacent memory to a network peer, and it is mapped to **`CWE-126`** and **`CWE-130`**. A second issue, **`CVE-2026-41681`**, affects versions from `0.10.39` up to, but not including, `0.10.78`, in `MdCtxRef::digest_final()`, which writes `EVP_MD_CTX_size(ctx)` bytes to the caller buffer without checking whether the buffer is large enough. The resulting out-of-bounds write can cause stack corruption and is reachable from safe Rust, with the weakness classified as **`CWE-121`**. Both vulnerabilities were addressed in **`rust-openssl 0.10.78`**, with public advisories, code references, and fix details released alongside the CVE records.
Jun 29, 2026
A critical vulnerability tracked as **`CVE-2026-55953`** affects Erlang/OTP SSL clients using **TLS 1.2 and earlier** as well as **DTLS**, allowing an on-path attacker to bypass server authentication and intercept supposedly secure sessions. The flaw occurs because the client does not verify that the cipher suite selected by the server was actually offered in the `ClientHello`, enabling an attacker to force an anonymous cipher suite and complete the handshake without certificate validation or hostname checking. Once the connection is established, the attacker can read and modify traffic; **TLS 1.3 is not affected** because it already performs the required cipher-suite membership check. The issue affects Erlang/OTP from **`OTP 17.0`** up to the patched releases **`27.3.4.15`**, **`28.5.0.4`**, and **`29.0.4`**, with corresponding SSL fixes in **`11.2.12.11`**, **`11.6.0.4`**, and **`11.7.4`**. Erlang/OTP maintainers addressed the bug in July with code changes to `ssl_handshake.erl` that add a pre-TLS 1.3 client cipher-suite validation check and trigger a fatal `illegal_parameter` alert if the negotiated suite was not advertised by the client. The vulnerability carries a **CVSS 4.0 score of 9.1** and is classified under **`CWE-757`**.
Jul 28, 2026