## rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert

- 種別: advisory
- 重大度: low
- 関連技術: rust
- 公開日時: 2026-10-27T16:08:59.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-vp88-798v-h67f)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-vp88-798v-h67f

影響: rust:rustls >= 0.23.44, < 0.23.46 → 0.23.46, rust:rustls >= 0.24.0-dev.1, < 0.24.0-dev.2 → 0.24.0-dev.2
In rustls 0.23.44 and 0.23.45, application data that a client buffers before the handshake completes is sent to the server even when the server rejects Encrypted Client Hello (ECH). When the server rejects ECH, the client completes the handshake with the outer ClientHello and authenticates the server against the ECH config's public_name. At the end of the handshake, start_traffic() encrypts and queues any plaintext buffered by ClientConnection::writer(). It does this before checking for EchStat…