{"action":"Upgrade rustls to 0.23.45 or later.","affected":[{"fixed":"0.23.45","introduced":"0.23.13"}],"component":"rustls","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["0.23.45"],"ghsa_id":"GHSA-2mjx-qc3c-rqvc","id":"tcs_01M5KEREQRDF611KP52BKHJCTY","modified_at":"2026-10-05T23:45:08.859781342Z","published_at":"2026-10-05T23:30:17Z","references":["https://osv.dev/vulnerability/GHSA-2mjx-qc3c-rqvc","https://github.com/rustls/rustls/security/advisories/GHSA-2mjx-qc3c-rqvc","https://github.com/golang/go/commit/5046bdf8a612b35a2c1a9e168054c1d5c65e7dd7","https://github.com/rustls/rustls/commit/98456aea708a7e3c6151e00ca2d4428e7a58257a","https://github.com/rustls/rustls","https://rustsec.org/advisories/RUSTSEC-2026-0285.html"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-2mjx-qc3c-rqvc","url":"https://osv.dev/vulnerability/GHSA-2mjx-qc3c-rqvc"}],"summary":"Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries"}