RUSTSEC-2026-0285: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries

| Details | |
| --- | --- |
| Package | `rustls` |
| Version | `0.23.20` |
| URL | https://github.com/rustls/rustls/security/advisories/GHSA-2mjx-qc3c-rqvc |
| Patched Versions | >=0.23.45 |
| Unaffected Versions | <0.23.13 |
| Aliases | [GHSA-2mjx-qc3c-rqvc](https://github.com/advisories/GHSA-2mjx-qc3c-rqvc) |

Rustls accepted TLS 1.3 handshake messages sent at the wrong encryption level
when they followed a key-changing message in the same record. For example,
a plaintext `EncryptedExtensions` message packed into the same record as the
`ServerHello` was accepted.

RFC 8446 section 5.1 requires that handshake messages do not span key changes,
and that implementations terminate the connection with an "unexpected_message"
alert if they do.

The handshake transcript is still authenticated, so a network-position attacker
cannot use this to alter or complete a handshake; the practical effect is that
a peer could send handshake messages that should be encrypted in plaintext
without rustls rejecting the connection.

This is functionally the same bug as Go's
[GO-2026-4340](https://pkg.go.dev/vuln/GO-2026-4340) (CVE-2025-61730).

Start by locating where this repository declares and locks its rustls 0.23.20 dependency, then compare the resolved version with the patched version 0.23.45. Review the dependency-related tests or checks available in the repository; done means the vulnerable version is no longer selected and the project’s validation passes.

Written by the indexing model from the issue text.