rustls CVE-2026-123612

Disclosure occurs ONLY when all of these hold on the client: (1) the client uses EchMode::Enable - GREASE ECH is explicitly NOT affected; (2) the application writes application data before the TLS handshake completes; and (3) it connects to a server that rejects the client's ECH config (e.g. a stale config, the same case where the server returns retry configs). Limiting factors sharply narrow real risk: the recipient of the leaked plaintext is the public_name (outer) server, which is properly authenticated - not an unauthenticated or arbitrary attacker - so an adversary must actually operate or legitimately present the certificate for that public_name server. The bug is only reachable at or after 0.23.44 because the pre-0.23.44 certificate check against the inner name failed verification first and sent no data. Affected versions: 0.23.44 and 0.23.45 only.

This is a genuinely low-to-moderate severity information-disclosure issue, not an emergency, and the signals are internally consistent. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N) yields 4.6 (Medium) and correctly reflects that the data leaks only to an already-authenticated party (PR:H) with limited confidentiality impact (VC:L) and no integrity or availability effect. There is no CISA KEV listing and no EPSS score supplied, so there is no evidence of active or widespread exploitation; exploitation status is 'no public exploit identified at time of analysis,' though two vendor/advisory references (rustls GHSA and VulnCheck) document the flaw in detail. The vuln.today priority is 'this_month,' not 'act_now'/'emergency,' which matches the picture of a real but non-urgent correctness bug. Crucially, per the GHSA advisory the recipient of the leaked plaintext is the properly authenticated public_name (outer) server - 'this is not an attack by an unauthenticated party' - so real-world risk depends on a specific, uncommon client configuration rather than opportunistic remote attack. The NVD CWE (CWE-696, incorrect behavior order) and the GHSA CWE (CWE-200, information exposure) differ but are complementary rather than conflicting: the ordering bug (sending data before the ech_required alert) is the mechanism, information disclosure is the consequence.

A client application built on rustls uses EchMode::Enable and writes application data (via ClientConnection::writer()) before the handshake completes; it connects to a server whose ECH config it holds is stale, so the server rejects ECH. At the end of the handshake start_traffic() encrypts and queues that buffered plaintext before the ech_required alert is queued, so when the application calls write_tls() the inner-server-intended data is delivered to and decrypted by the authenticated public_name outer server before it receives the fatal alert. No working exploit code is published; the two references are advisories, not verified exploits.