rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert

影響: rust:rustls >= 0.23.44, < 0.23.46 → 0.23.46, rust:rustls >= 0.24.0-dev.1, < 0.24.0-dev.2 → 0.24.0-dev.2

In rustls 0.23.44 and 0.23.45, application data that a client buffers before the handshake completes is sent to the server even when the server rejects Encrypted Client Hello (ECH). When the server rejects ECH, the client completes the handshake with the outer ClientHello and authenticates the server against the ECH config's public_name. At the end of the handshake, start_traffic() encrypts and queues any plaintext buffered by ClientConnection::writer(). It does this before checking for EchStat…

在 GitHub Advisory Database 阅读

2026/10/28 01:08，GitHub Advisory Database 发布了“rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert”（类型：漏洞公告）。严重程度为“低危”（low）。相关技术：Rust。