The Debug implementations of Tls12ClientSessionValue and Tls13ClientSessionValue were derived, and so included the TLS 1.2 master
secret or TLS 1.3 resumption PSK in their output.
Custom ClientSessionStore implementations that format these values with Debug (for example, when logging) could disclose these secrets to readers of
the logs. This conflicts with rustls's key-material redaction policy.
Ordinary connection and built-in session cache Debug output is redacted and
is not affected.
> `Debug` impls for client session values expose TLS secrets
| Details | |
| ------------------- | ---------------------------------------------- |
| Package | `rustls` |
| Version | `0.23.45` |
| URL | [https://github.com/rustls/rustls/pull/3299](https://github.com/rustls/rustls/pull/3299) |
| Date | 2026-10-14 |
| Patched versions | `>=0.23.46` |
| Unaffected versions | `<0.21.0` |
The `Debug` implementations of `Tls12ClientSessionValue` and
`Tls13ClientSessionValue` were derived, and so included the TLS 1.2 master
secret or TLS 1.3 resumption PSK in their output.
Custom `ClientSessionStore` implementations that format these values with
`Debug` (for example, when logging) could disclose these secrets to readers of
the logs. This conflicts with rustls's
[key-material redaction policy](https://github.com/rustls/rustls/blob/99f2358cae2954837dbb866faf6727de75489ab9/SECURITY.md#boundary-public-api).
Ordinary connection and built-in session cache `Debug` output is redacted and
is not affected.
See [advisory page](https://rustsec.org/advisories/RUSTSEC-2026-0346.html) for additional details.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
rustls0.23.45>=0.23.46<0.21.0The
Debugimplementations ofTls12ClientSessionValueandTls13ClientSessionValuewere derived, and so included the TLS 1.2 mastersecret or TLS 1.3 resumption PSK in their output.
Custom
ClientSessionStoreimplementations that format these values withDebug(for example, when logging) could disclose these secrets to readers ofthe logs. This conflicts with rustls's
key-material redaction policy.
Ordinary connection and built-in session cache
Debugoutput is redacted andis not affected.
See advisory page for additional details.