rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert

影響: rust:rustls >= 0.23.44, < 0.23.46 → 0.23.46, rust:rustls >= 0.24.0-dev.1, < 0.24.0-dev.2 → 0.24.0-dev.2

In rustls 0.23.44 and 0.23.45, application data that a client buffers before the handshake completes is sent to the server even when the server rejects Encrypted Client Hello (ECH). When the server rejects ECH, the client completes the handshake with the outer ClientHello and authenticates the server against the ECH config's public_name. At the end of the handshake, start_traffic() encrypts and queues any plaintext buffered by ClientConnection::writer(). It does this before checking for EchStat…

Read on GitHub Advisory Database

On 10/28/2026, 01:08 AM, GitHub Advisory Database published "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert" (type: Advisory). Severity is "Low" (low). Related technologies: Rust.