rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert

影響: rust:rustls >= 0.23.44, < 0.23.46 → 0.23.46, rust:rustls >= 0.24.0-dev.1, < 0.24.0-dev.2 → 0.24.0-dev.2

In rustls 0.23.44 and 0.23.45, application data that a client buffers before the handshake completes is sent to the server even when the server rejects Encrypted Client Hello (ECH). When the server rejects ECH, the client completes the handshake with the outer ClientHello and authenticates the server against the ECH config's public_name. At the end of the handshake, start_traffic() encrypts and queues any plaintext buffered by ClientConnection::writer(). It does this before checking for EchStat…

GitHub Advisory Databaseで読む

2026/10/28 01:08、GitHub Advisory Databaseが「rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「注意」(low) です。関連する技術: Rust。