News › security
By The Linux Camp News, October 14, 2026
The October 14 release addresses Brotli memory allocation, secrets in debug logs, cached key-exchange preferences and application data sent after ECH rejection. Exposure depends on the application’s configuration and workflow.
Rustls released version 0.23.46 on October 14, 2026, with four security-relevant fixes in the Rust TLS library. The changes address certificate decompression, session debug output, remembered key-exchange preferences and handling of buffered application data. These are separate exposure paths, rather than one vulnerability affecting every Rustls connection. 1 2 5
The Brotli defect illustrates why limiting decompressed output does not necessarily bound decompression memory. Rustls capped the resulting certificate size, but the decoder also allocated an internal history window whose size came from the input. According to the maintainer advisory, a five-byte header could request a 1 GiB allocation before authentication. Version 0.23.46 rejects large-window Brotli streams, closing that allocation path. 5 2 1
Brotli is disabled by default, so this is not a universal denial-of-service exposure. An affected client must enable Brotli and connect to a malicious peer; an affected server must enable it and request client certificates. Neither direction requires the attacker to have a trusted certificate. If the allocator cannot satisfy the request, the process can abort. For operators, the useful first check is therefore Brotli configuration and, on servers, client authentication, not merely whether Rustls is present. 5
The session-output fix stops printing secrets when session values are formatted for debugging. Phoronix identifies the exposed material as TLS master secrets and resumption pre-shared keys. The reported disclosure route is through log files, not automatic transmission of keys on every connection. Reviewing whether session objects enter diagnostic logs is consequently more useful than treating all application logging as affected. 1 2
The key-exchange change moves a cache update behind handshake confirmation. The cache stores a preference for a particular server name, allowing a later connection to remember the server’s preferred key-exchange group. Previously, an unauthenticated ServerHello could poison that preference so later ClientHellos offered only a classical X25519 share. Waiting for confirmation prevents an unconfirmed handshake from establishing that hint; the release notes do not establish that an attacker could decrypt traffic. 2 3 4
The fourth fix concerns Encrypted Client Hello, or ECH, and specifically names Rustls 0.23.44 and 0.23.45. In those versions, application data buffered by a client before handshake completion could still be sent when the server rejected ECH. Version 0.23.46 fails on rejection before encrypting application data. The workflow to inspect is therefore clients using ECH that queue application writes before the handshake finishes. 2 3
For remediation planning, the maintainer material retrieved October 14, 2026 identifies 0.23.46 as the release containing these fixes. The Brotli advisory separately lists affected versions below 0.23.46 and patched versions at or above 0.23.46 or 0.24.0-dev.2. Keep that range specific to Brotli: the supplied material does not give full affected-version ranges for the session-debug and key-exchange-hint issues. 2 5