Stream: git-wasmtime

Topic: wasmtime / issue #14763 RUSTSEC-2026-0346: `Debug` impls ...

Wasmtime GitHub notifications bot (Oct 15 2026 at 00:13):

github-actions[bot] opened issue #14763:

Debug impls for client session values expose TLS secrets

Details
Package	rustls
Version	0.23.45
URL	https://github.com/rustls/rustls/pull/3299
Date	2026-10-14
Patched versions	>=0.23.46
Unaffected versions	<0.21.0

The Debug implementations of Tls12ClientSessionValue and
Tls13ClientSessionValue were derived, and so included the TLS 1.2 master
secret or TLS 1.3 resumption PSK in their output.

Custom ClientSessionStore implementations that format these values with
Debug (for example, when logging) could disclose these secrets to readers of
the logs. This conflicts with rustls's
key-material redaction policy.

Ordinary connection and built-in session cache Debug output is redacted and
is not affected.

See advisory page for additional details.

Wasmtime GitHub notifications bot (Oct 15 2026 at 14:50):

alexcrichton closed issue #14763:

Debug impls for client session values expose TLS secrets

Details
Package	rustls
Version	0.23.45
URL	https://github.com/rustls/rustls/pull/3299
Date	2026-10-14
Patched versions	>=0.23.46
Unaffected versions	<0.21.0

The Debug implementations of Tls12ClientSessionValue and
Tls13ClientSessionValue were derived, and so included the TLS 1.2 master
secret or TLS 1.3 resumption PSK in their output.

Custom ClientSessionStore implementations that format these values with
Debug (for example, when logging) could disclose these secrets to readers of
the logs. This conflicts with rustls's
key-material redaction policy.

Ordinary connection and built-in session cache Debug output is redacted and
is not affected.

See advisory page for additional details.

Last updated: Oct 31 2026 at 23:03 UTC