{"id":"ghsa-ghsa-vp88-798v-h67f","seq":1708774,"kind":"advisory","title":"rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert","url":"https://github.com/advisories/GHSA-vp88-798v-h67f","permalink":"https://vulnpulse.app/items/ghsa-ghsa-vp88-798v-h67f","summary":"影響: rust:rustls >= 0.23.44, < 0.23.46 → 0.23.46, rust:rustls >= 0.24.0-dev.1, < 0.24.0-dev.2 → 0.24.0-dev.2\nIn rustls 0.23.44 and 0.23.45, application data that a client buffers before the handshake completes is sent to the server even when the server rejects Encrypted Client Hello (ECH). When the server rejects ECH, the client completes the handshake with the outer ClientHello and authenticates the server against the ECH config's public_name. At the end of the handshake, start_traffic() encrypts and queues any plaintext buffered by ClientConnection::writer(). It does this before checking for EchStat…","severity":"low","techs":["rust"],"cves":[],"tags":["GHSA-vp88-798v-h67f","rustls","rustls"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T16:08:59.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}