Skip to content

Update rustls - #2095

Merged
shunichironomura merged 1 commit into
mainfrom
update-rustls
Oct 15, 2026
Merged

shunichironomura merged 1 commit into
mainfrom
update-rustls

Conversation

@shunichironomura

@shunichironomura shunichironomura commented Oct 15, 2026 •

Copy link
Copy Markdown
Member

Output of cargo audit

Crate:     rustls
Version:   0.23.45
Title:     `Debug` impls for client session values expose TLS secrets
Date:      2026-10-14
ID:        RUSTSEC-2026-0346
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0346
Severity:  4 (medium)
Solution:  Upgrade to >=0.23.46

Crate:     rustls
Version:   0.23.45
Title:     Buffered application data sent to outer server after ECH rejection
Date:      2026-10-14
ID:        RUSTSEC-2026-0347
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0347
Severity:  2.3 (low)
Solution:  Upgrade to >=0.23.46

Crate:     rustls
Version:   0.23.45
Title:     Brotli certificate decompression can allocate up to 1 GiB before authentication
Date:      2026-10-14
ID:        RUSTSEC-2026-0348
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0348
Severity:  3.7 (low)
Solution:  Upgrade to >=0.23.46

Crate:     rustls
Version:   0.23.45
Title:     Unauthenticated ServerHello can downgrade later connections to classical key exchange
Date:      2026-10-14
ID:        RUSTSEC-2026-0349
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0349
Severity:  3.7 (low)
Solution:  Upgrade to >=0.23.46

This is part 1 of 2 in a stack made with GitButler:

@shunichironomura
shunichironomura enabled auto-merge (squash) October 15, 2026 01:18
@shunichironomura
shunichironomura merged commit 4a8282a into main Oct 15, 2026
47 checks passed
@shunichironomura
shunichironomura deleted the update-rustls branch October 15, 2026 02:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant