CVE-2026-123612
2.3 LOWpublic exploit availablePublished 2026-11-08 · Updated 2026-11-08
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
rustls 0.23.44 and 0.23.45 contain an information disclosure vulnerability that sends application data buffered before the handshake completes to the client-facing server when Encrypted Client Hello is rejected. Because start_traffic() queues plaintext from ClientConnection::writer() before sending the ech_required alert, the authenticated public_name server receives data intended for the inner server.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-696
Public exploit & PoC references
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- UNSCOREDCVE-2026-103012PoC
- MEDIUMCVE-2026-103353
- MEDIUMCVE-2026-105745PoC
- UNSCOREDCVE-2026-109162PoC
- HIGHCVE-2026-110450
- UNSCOREDCVE-2026-112186PoC
- HIGHCVE-2026-114145PoC
- HIGHCVE-2026-121291
Related by shared AI tags and CWE weakness class. Browse the full archive.