The vulnerability occurs when the rustls library formats client session data for debugging. The debug formatting process unintentionally includes TLS master secret key material in the output. When a CustomClientSessionStore implementation logs Tls12ClientSessionValue or Tls13ClientSessionValue, the logs reveal TLS 1.2 master secrets or TLS 1.3 resumption pre‑shared keys, compromising confidentiality.

The affected product is the rustls library from rustls_project. Versions prior to 0.23.46 and 0.24.0-dev.1 prior to 0.24.0-dev.2 are vulnerable. Applications embedding these versions are at risk if they perform debug logging of session values.

The CVSS score of 4.1 classifies this issue as low severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires access to application code that logs session objects or to read the logs; there is no remote code execution vector. The primary attack path is via log inspection or compromised log storage, representing a confidentiality breach for systems where logs may be exposed.