Summary
Track a reviewed update for GHSA-2mjx-qc3c-rqvc / RUSTSEC-2026-0285, currently affecting coop's locked rustls 0.23.43. Current recommendation: wait, with moderate confidence, pending cooldown and the validation below. A Dependabot PR should link this issue; its creation or the passage of seven days does not establish review completion.
The advisory covers rustls 0.23.13–0.23.44 and identifies 0.23.45 as patched. It concerns handshake messages accepted across TLS 1.3 encryption-level boundaries. Static review supports the alignment fix, but the candidate includes unrelated changes and requires native crypto dependency updates.
References: GHSA, immutable RustSec entry, release.
Timing and minimum dependency scope
The registry publication timestamp is 2026-09-14 15:11:17.808465 UTC, giving seven-day eligibility at 2026-09-21 15:11:17.808465 UTC. This uses registry publication, not the slightly earlier GitHub release timestamp. The candidate was about 16 hours old during the September 15 review.
| Package |
Currently locked |
Minimum candidate |
Candidate publication (UTC) |
| rustls |
0.23.43 |
0.23.45 |
September 14, 2026 |
| rustls-webpki |
0.103.13 |
0.103.14 |
August 11, 2026 |
| aws-lc-rs |
1.17.1 |
1.18.0 |
August 7, 2026 |
| aws-lc-sys |
0.42.0 |
0.44.0 |
August 7, 2026 |
This is a metadata-compatible minimum, not an executed Cargo resolution. Rustls requires AWS-LC ^1.18 and webpki ^0.103.14; AWS-LC 1.18 requires native sys ^0.44.0. Existing locked build dependencies satisfy the inspected requirements; no other necessary package change was identified. Do not silently broaden the update to newer versions. The three additional candidates have passed seven days, but still require review.
Coop's Dependabot configuration uses weekly Cargo updates and a seven-day cooldown. GitHub's documented cooldown does not apply to security updates. A security PR may therefore arrive early; the normal Monday run could occur before September 21 eligibility and defer pickup until September 28. Neither behavior authorizes a cooldown exception.
Review findings that affect the decision
1. Unrelated server retry regression found by static inspection
The new server/tls13.rs check at line 211 rejects a second ClientHello without pre_shared_key whenever the first offered one. It does not distinguish incompatible resumption keys.
Concrete source-traced trigger:
- A client caches a SHA-256 resumption ticket.
- On a later connection the server selects a SHA-384 cipher suite and requests a different key share through HelloRetryRequest; the client supports both suites/groups.
- Rustls's own client drops the incompatible ticket: client/hs.rs:603 returns before adding the PSK extension because resumption compatibility requires matching hashes.
- The .45 server aborts with
MissingPskExtensionInSecondClientHello instead of allowing a full handshake.
RFC 8446 §4.1.2 permits removal of incompatible PSKs after retry. The added upstream test removes a compatible dummy PSK and does not cover this neighboring case. The change was introduced in 9fafe6dd.
Status: independently checked source trace; not dynamically reproduced. This is an interoperability finding, not demonstrated authentication bypass. Coop uses rustls as a client, so installing .45 does not directly exercise this server branch. Resolve or explicitly assess its relevance before adoption; any upstream report should retain the reproduction limitation.
2. The native dependency review remains incomplete
The update includes aws-lc-sys 0.42.0 → 0.44.0, with native C/assembly, generated bindings, build machinery and prebuilt objects. Candidate crates were downloaded, checked for unsafe archive paths/types, hashed and their manifests inspected, but the complete additional dependency source/provenance review is unfinished. Age and matching registry checksums do not close this gap.
3. Alignment fix looks correct statically; execution evidence is missing
The fix changes alignment from “all buffered messages are complete” to “no pending handshake messages,” and refreshes the flag after consuming a message. Both edits matter. This prevents a complete plaintext EncryptedExtensions buffered behind ServerHello from being consumed after the key change. Static tracing covered client/server TLS 1.2/1.3 boundaries, buffered/unbuffered consumption, QUIC level separation and fatal-error paths.
The upstream real-flight regression preserves the transcript while moving EncryptedExtensions into the plaintext record. Its expected rejection appears discriminating, but neither the test nor deliberate mutations were executed. No compliant disposable VM was available. Bogo also still skips ML-DSA signing patterns despite the provider expansion; a separate API test covers one ML-DSA chain combination.
Coop exposure and completed provenance checks
Reviewed coop commit 6441210ed14fa123cf3e53401b266f3966cc8e03. coop-proxy enables std, tls12, and aws_lc_rs with rustls defaults disabled. Its TLS configuration uses Mozilla roots, hostname verification and no client certificates. It connects to fixed provider hosts; guest-facing transport is plain HTTP over the tunnel. Both platforms share this path.
The affected client parser is reachable during outbound TLS 1.3 handshakes in proxy mode. The maintainer assessment says transcript authentication remains intact; the review did not establish that an unauthenticated network attacker can complete a modified handshake or steal coop API credentials. This does not currently justify urgent adoption before cooldown.
The review covered 42 rustls commits / 38 changed paths across the complete .43 → .45 range, including .44. Unrelated changes include ML-DSA support, ECH rejection name verification, TLS 1.2 signature restrictions, nonempty OCSP checks, Unix key-log permissions, private-key zeroization and HRR checks.
For each of .43/.44/.45, 116 of 119 published files match the corresponding repository bytes after accounting for copied README/licenses and Cargo.toml.orig. The other files are Cargo manifest/lock/VCS metadata; normalized dependency and feature declarations were checked against source. No unexplained rustls source additions or clear prompt-injection attempt were found. This does not prove the release is safe.
Candidate rustls source: 2976d90fd1c2db6b518700dd101b714069cfcb17. Its crate SHA-256 is 0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634. Downloaded bytes match registry metadata/index. The tag is lightweight, the commit is reported unsigned, and no independently verified artifact attestation was obtained. Registry publisher continuity was observed, but historical ownership/tag movement was not established. Same-origin checksums establish consistency, not independent authenticity.
Related context: #475 changes marketplace registration and has a failed deny job. Accessible annotations only show exit code 1; the review could not independently confirm that rustls caused that specific failure.
Completion criteria
No advisory exception, CI bypass or early-adoption exception is proposed by this issue. Review observations are as of September 15, 2026; no candidate builds, tests, executable mutations or integration suites were run during that review.
Summary
Track a reviewed update for GHSA-2mjx-qc3c-rqvc / RUSTSEC-2026-0285, currently affecting coop's locked rustls 0.23.43. Current recommendation: wait, with moderate confidence, pending cooldown and the validation below. A Dependabot PR should link this issue; its creation or the passage of seven days does not establish review completion.
The advisory covers rustls 0.23.13–0.23.44 and identifies 0.23.45 as patched. It concerns handshake messages accepted across TLS 1.3 encryption-level boundaries. Static review supports the alignment fix, but the candidate includes unrelated changes and requires native crypto dependency updates.
References: GHSA, immutable RustSec entry, release.
Timing and minimum dependency scope
The registry publication timestamp is 2026-09-14 15:11:17.808465 UTC, giving seven-day eligibility at 2026-09-21 15:11:17.808465 UTC. This uses registry publication, not the slightly earlier GitHub release timestamp. The candidate was about 16 hours old during the September 15 review.
This is a metadata-compatible minimum, not an executed Cargo resolution. Rustls requires AWS-LC
^1.18and webpki^0.103.14; AWS-LC 1.18 requires native sys^0.44.0. Existing locked build dependencies satisfy the inspected requirements; no other necessary package change was identified. Do not silently broaden the update to newer versions. The three additional candidates have passed seven days, but still require review.Coop's Dependabot configuration uses weekly Cargo updates and a seven-day cooldown. GitHub's documented cooldown does not apply to security updates. A security PR may therefore arrive early; the normal Monday run could occur before September 21 eligibility and defer pickup until September 28. Neither behavior authorizes a cooldown exception.
Review findings that affect the decision
1. Unrelated server retry regression found by static inspection
The new server/tls13.rs check at line 211 rejects a second ClientHello without
pre_shared_keywhenever the first offered one. It does not distinguish incompatible resumption keys.Concrete source-traced trigger:
MissingPskExtensionInSecondClientHelloinstead of allowing a full handshake.RFC 8446 §4.1.2 permits removal of incompatible PSKs after retry. The added upstream test removes a compatible dummy PSK and does not cover this neighboring case. The change was introduced in 9fafe6dd.
Status: independently checked source trace; not dynamically reproduced. This is an interoperability finding, not demonstrated authentication bypass. Coop uses rustls as a client, so installing .45 does not directly exercise this server branch. Resolve or explicitly assess its relevance before adoption; any upstream report should retain the reproduction limitation.
2. The native dependency review remains incomplete
The update includes
aws-lc-sys 0.42.0 → 0.44.0, with native C/assembly, generated bindings, build machinery and prebuilt objects. Candidate crates were downloaded, checked for unsafe archive paths/types, hashed and their manifests inspected, but the complete additional dependency source/provenance review is unfinished. Age and matching registry checksums do not close this gap.3. Alignment fix looks correct statically; execution evidence is missing
The fix changes alignment from “all buffered messages are complete” to “no pending handshake messages,” and refreshes the flag after consuming a message. Both edits matter. This prevents a complete plaintext EncryptedExtensions buffered behind ServerHello from being consumed after the key change. Static tracing covered client/server TLS 1.2/1.3 boundaries, buffered/unbuffered consumption, QUIC level separation and fatal-error paths.
The upstream real-flight regression preserves the transcript while moving EncryptedExtensions into the plaintext record. Its expected rejection appears discriminating, but neither the test nor deliberate mutations were executed. No compliant disposable VM was available. Bogo also still skips ML-DSA signing patterns despite the provider expansion; a separate API test covers one ML-DSA chain combination.
Coop exposure and completed provenance checks
Reviewed coop commit
6441210ed14fa123cf3e53401b266f3966cc8e03.coop-proxyenablesstd,tls12, andaws_lc_rswith rustls defaults disabled. Its TLS configuration uses Mozilla roots, hostname verification and no client certificates. It connects to fixed provider hosts; guest-facing transport is plain HTTP over the tunnel. Both platforms share this path.The affected client parser is reachable during outbound TLS 1.3 handshakes in proxy mode. The maintainer assessment says transcript authentication remains intact; the review did not establish that an unauthenticated network attacker can complete a modified handshake or steal coop API credentials. This does not currently justify urgent adoption before cooldown.
The review covered 42 rustls commits / 38 changed paths across the complete .43 → .45 range, including .44. Unrelated changes include ML-DSA support, ECH rejection name verification, TLS 1.2 signature restrictions, nonempty OCSP checks, Unix key-log permissions, private-key zeroization and HRR checks.
For each of .43/.44/.45, 116 of 119 published files match the corresponding repository bytes after accounting for copied README/licenses and
Cargo.toml.orig. The other files are Cargo manifest/lock/VCS metadata; normalized dependency and feature declarations were checked against source. No unexplained rustls source additions or clear prompt-injection attempt were found. This does not prove the release is safe.Candidate rustls source:
2976d90fd1c2db6b518700dd101b714069cfcb17. Its crate SHA-256 is0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634. Downloaded bytes match registry metadata/index. The tag is lightweight, the commit is reported unsigned, and no independently verified artifact attestation was obtained. Registry publisher continuity was observed, but historical ownership/tag movement was not established. Same-origin checksums establish consistency, not independent authenticity.Related context: #475 changes marketplace registration and has a failed deny job. Accessible annotations only show exit code 1; the review could not independently confirm that rustls caused that specific failure.
Completion criteria
No advisory exception, CI bypass or early-adoption exception is proposed by this issue. Review observations are as of September 15, 2026; no candidate builds, tests, executable mutations or integration suites were run during that review.