rustls 0.23.45

Source: https://github.com/rustls/rustls
Commit scanned: 2976d90fd1c2 (recorded by crates.io)
Directory: rustls (only this part of the repository was scanned)
Compared with: 64ad386785c7 (0 signals introduced since)
Files: 127 scanned, 58 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 16 info
Scan time: 13.2 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 16 of 16 warn and critical signals; 16 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 20:56

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review encoding-hex rustls/src/crypto/tls12.rs:99:24

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
    fn check_sha256() {
        let secret = b"\x9b\xbe\x43\x6b\xa9\x40\xf0\x17\xb1\x76\x52\x84\x9a\x71\xdb\x35";
        let seed = b"\xa0\xba\x9f\x93\x6c\xda\x31\x18\x27\xa6\xf7\x96\xff\xd5\x19\x8c";
        let label = b"test label";
```
dismissed LLM, confidence 0.93 Byte-string literal holding a TLS PRF test secret for SHA-256.
Reasoning
The hex escapes are fixed PRF test-vector secrets and seeds in a TLS 1.2 crypto test module, compared against included expected-output files. This is a standard known-answer test and the raw-pass hex signal is a false positive.
info ~~warn~~ → info by review encoding-hex rustls/src/crypto/tls12.rs:100:22

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
        let secret = b"\x9b\xbe\x43\x6b\xa9\x40\xf0\x17\xb1\x76\x52\x84\x9a\x71\xdb\x35";
        let seed = b"\xa0\xba\x9f\x93\x6c\xda\x31\x18\x27\xa6\xf7\x96\xff\xd5\x19\x8c";
        let label = b"test label";
        let expect = include_bytes!("../testdata/prf-result.1.bin");
```
dismissed LLM, confidence 0.93 Test secret and seed bytes for a TLS PRF known-answer test.
Reasoning
Same test-vector block: the secret and seed are known-answer inputs for the PRF test, with the expected output loaded from testdata. Nothing executes or hides a payload.
info ~~warn~~ → info by review encoding-hex rustls/src/crypto/tls12.rs:117:24

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
    fn check_sha512() {
        let secret = b"\xb0\x32\x35\x23\xc1\x85\x35\x99\x58\x4d\x88\x56\x8b\xbb\x05\xeb";
        let seed = b"\xd4\x64\x0e\x12\xe4\xbc\xdb\xfb\x43\x7f\x03\xe6\xae\x41\x8e\xe5";
        let label = b"test label";
```
dismissed LLM, confidence 0.93 Test secret bytes for the SHA-512 PRF known-answer test.
Reasoning
SHA-512 PRF test vector inputs in a unit test, paired with testdata expected output. This is ordinary cryptographic test data.
info ~~warn~~ → info by review encoding-hex rustls/src/crypto/tls12.rs:118:22

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
        let secret = b"\xb0\x32\x35\x23\xc1\x85\x35\x99\x58\x4d\x88\x56\x8b\xbb\x05\xeb";
        let seed = b"\xd4\x64\x0e\x12\xe4\xbc\xdb\xfb\x43\x7f\x03\xe6\xae\x41\x8e\xe5";
        let label = b"test label";
        let expect = include_bytes!("../testdata/prf-result.2.bin");
```
dismissed LLM, confidence 0.93 Test seed bytes for the SHA-512 PRF known-answer test.
Reasoning
Seed bytes for the SHA-512 PRF test vector, as above. The high-entropy look is expected for cryptographic constants.
info ~~warn~~ → info by review encoding-hex rustls/src/crypto/tls12.rs:135:24

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
    fn check_sha384() {
        let secret = b"\xb8\x0b\x73\x3d\x6c\xee\xfc\xdc\x71\x56\x6e\xa4\x8e\x55\x67\xdf";
        let seed = b"\xcd\x66\x5c\xf6\xa8\x44\x7d\xd6\xff\x8b\x27\x55\x5e\xdb\x74\x65";
        let label = b"test label";
```
dismissed LLM, confidence 0.93 Test secret bytes for the SHA-384 PRF known-answer test.
Reasoning
SHA-384 PRF test vector inputs in a unit test with external expected output. Standard crypto test data.
info ~~warn~~ → info by review encoding-hex rustls/src/crypto/tls12.rs:136:22

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
        let secret = b"\xb8\x0b\x73\x3d\x6c\xee\xfc\xdc\x71\x56\x6e\xa4\x8e\x55\x67\xdf";
        let seed = b"\xcd\x66\x5c\xf6\xa8\x44\x7d\xd6\xff\x8b\x27\x55\x5e\xdb\x74\x65";
        let label = b"test label";
        let expect = include_bytes!("../testdata/prf-result.3.bin");
```
dismissed LLM, confidence 0.93 Test seed bytes for the SHA-384 PRF known-answer test.
Reasoning
SHA-384 PRF test seed bytes in a known-answer test. Benign test data with the expected result in a separate file.
info ~~warn~~ → info by review encoding-hex rustls/src/msgs/message_test.rs:57:9

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
        \x16\x03\x01\x00\xeb\x01\x00\x00\xe7\x03\x03\xb6\x1f\xe4\x3a\x55\
        \x90\x3e\xc0\x28\x9c\x12\xe0\x5c\x84\xea\x90\x1b\xfb\x11\xfc\xbd\
        \x25\x55\xda\x9f\x51\x93\x1b\x8d\x92\x66\xfd\x00\x00\x2e\xc0\x2c\
        \xc0\x2b\xc0\x24\xc0\x23\xc0\x0a\xc0\x09\xcc\xa9\xc0\x30\xc0\x2f\
```
dismissed LLM, confidence 0.92 Multi-line byte literal containing a captured TLS ClientHello for parser testing.
Reasoning
The escapes form a captured TLS ClientHello record (0x16 handshake, 0x0301 version, cipher suite list) used as parser input in a message test. Recorded protocol bytes are expected in such a test.
info ~~warn~~ → info by review encoding-hex rustls/src/msgs/message_test.rs:58:9

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
        \x90\x3e\xc0\x28\x9c\x12\xe0\x5c\x84\xea\x90\x1b\xfb\x11\xfc\xbd\
        \x25\x55\xda\x9f\x51\x93\x1b\x8d\x92\x66\xfd\x00\x00\x2e\xc0\x2c\
        \xc0\x2b\xc0\x24\xc0\x23\xc0\x0a\xc0\x09\xcc\xa9\xc0\x30\xc0\x2f\
        \xc0\x28\xc0\x27\xc0\x14\xc0\x13\xcc\xa8\x00\x9d\x00\x9c\x00\x3d\
```
dismissed LLM, confidence 0.92 Continuation of a recorded TLS ClientHello byte fixture for message parsing tests.
Reasoning
Continuation of the captured TLS ClientHello test vector: cipher suite list bytes fed to the message reader. Benign test fixture.
info ~~warn~~ → info by review encoding-hex rustls/src/msgs/message_test.rs:68:9

16 consecutive `\xNN` escapes (entropy 3.5 bits/byte) (raw pass, confidence 0.65)
```
        \x32\x05\x68\x32\x2d\x31\x36\x05\x68\x32\x2d\x31\x35\x05\x68\x32\
        \x2d\x31\x34\x08\x73\x70\x64\x79\x2f\x33\x2e\x31\x06\x73\x70\x64\
        \x79\x2f\x33\x08\x68\x74\x74\x70\x2f\x31\x2e\x31\x00\x0b\x00\x02\
        \x01\x00\x00\x0a\x00\x0a\x00\x08\x00\x1d\x00\x17\x00\x18\x00\x19";
```
dismissed LLM, confidence 0.92 Tail of a recorded TLS ClientHello fixture with ALPN and extension bytes.
Reasoning
The bytes encode ALPN and extension data of a ClientHello (h2, http/1.1, spdy, ec point formats, supported groups) in a parser test. Expected protocol content, not a payload.
info ~~warn~~ → info by review encoding-hex rustls/src/msgs/message_test.rs:69:9

16 consecutive `\xNN` escapes (entropy 3.5 bits/byte) (raw pass, confidence 0.65)
```
        \x2d\x31\x34\x08\x73\x70\x64\x79\x2f\x33\x2e\x31\x06\x73\x70\x64\
        \x79\x2f\x33\x08\x68\x74\x74\x70\x2f\x31\x2e\x31\x00\x0b\x00\x02\
        \x01\x00\x00\x0a\x00\x0a\x00\x08\x00\x1d\x00\x17\x00\x18\x00\x19";
    let mut rd = Reader::init(bytes);
```
dismissed LLM, confidence 0.92 Closing extension bytes of a recorded TLS ClientHello test fixture.
Reasoning
Final extension bytes of the captured ClientHello test fixture, consumed by a Reader in the test. Benign protocol test data.
info ~~warn~~ → info by review encoding-hex rustls/tests/api.rs:7636:9

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
        \x16\x03\x01\x00\xc8\x01\x00\x00\xc4\x03\x03\xec\x12\xdd\x17\x64\
        \xa4\x39\xfd\x7e\x8c\x85\x46\xb8\x4d\x1e\xa0\x6e\xb3\xd7\xa0\x51\
        \xf0\x3c\xb8\x17\x47\x0d\x4c\x54\xc5\xdf\x72\x00\x00\x1c\xea\xea\
        \xc0\x2b\xc0\x2f\xc0\x2c\xc0\x30\xcc\xa9\xcc\xa8\xc0\x13\xc0\x14\
```
likely benign LLM, confidence 0.93 Byte-literal TLS ClientHello test fixture in a Rust integration test.
Reasoning
The snippet is a run of hex escapes that decodes to a TLS ClientHello (record header 0x16 0x03 0x01, cipher suite list such as 0xc02b/0xc02f, 0xcca9). In a Rust test file this is a recorded handshake fixture, consistent with testing TLS parsing or fingerprinting. The raw pass flags it only because the byte sequence looks encoded.
info ~~warn~~ → info by review encoding-hex rustls/tests/api.rs:7637:9

16 consecutive `\xNN` escapes (entropy 3.8 bits/byte) (raw pass, confidence 0.65)
```
        \xa4\x39\xfd\x7e\x8c\x85\x46\xb8\x4d\x1e\xa0\x6e\xb3\xd7\xa0\x51\
        \xf0\x3c\xb8\x17\x47\x0d\x4c\x54\xc5\xdf\x72\x00\x00\x1c\xea\xea\
        \xc0\x2b\xc0\x2f\xc0\x2c\xc0\x30\xcc\xa9\xcc\xa8\xc0\x13\xc0\x14\
        \x00\x9c\x00\x9d\x00\x2f\x00\x35\x00\x0a\x01\x00\x00\x7f\xda\xda\
```
likely benign LLM, confidence 0.93 Continuation of a TLS ClientHello byte fixture in a Rust test.
Reasoning
This continues the same TLS ClientHello byte fixture, with cipher suites and extension bytes (0x009c, 0x002f, 0x0a). It is test data in a tests/ file, with no execution or decoding of the bytes into anything dangerous.
info ~~warn~~ → info by review encoding-hex rustls/tests/api.rs:7645:9

16 consecutive `\xNN` escapes (entropy 3.5 bits/byte) (raw pass, confidence 0.65)
```
        \x01\x00\x05\x00\x05\x01\x00\x00\x00\x00\x00\x12\x00\x00\x00\x10\
        \x00\x0e\x00\x0c\x02\x68\x32\x08\x68\x74\x74\x70\x2f\x31\x2e\x31\
        \x75\x50\x00\x00\x00\x0b\x00\x02\x01\x00\x00\x0a\x00\x0a\x00\x08\
        \x1a\x1a\x00\x1d\x00\x17\x00\x18\x1a\x1a\x00\x01\x00\
```
likely benign LLM, confidence 0.92 TLS extension bytes (ALPN, supported groups) in a Rust test fixture.
Reasoning
The bytes encode TLS extensions (ALPN with h2 and http/1.1, supported groups, signature algorithms). This is a structurally valid handshake capture used as a parser or fingerprint test vector. The raw-pass hex-escape signal is a false positive on binary test data.
info ~~warn~~ → info by review encoding-base64 rustls/tests/ech.rs:119:6

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
const BASE64_ECHCONFIG_LIST_LOCALHOST: &str =
    "AED+DQA8AAAgACAxoIJyV36iDlfFRmqE+ho2PxXE0EISPfUUJYKCy6T8VwAIAAEAAQABAAOACWxvY2FsaG9zdAAA";

// Two EchConfigs, both with server-name "cloudflare-esni.com".
```
likely benign LLM, confidence 0.95 Base64 ECHConfigList test constant for localhost.
Reasoning
This is a base64-encoded ECHConfigList for localhost, a standard Encrypted Client Hello test vector. The 'AED+DQ' prefix and the structure match the ECH draft format. It is a constant string in a test file, not a payload or an obfuscated command.
info ~~warn~~ → info by review encoding-base64 rustls/tests/ech.rs:122:41

base64-like blob (236 bytes, compression ratio 0.90) (raw pass, confidence 0.60)
```
const BASE64_ECHCONFIG_LIST_CF: &str = "AK3+DQBCwwAgACAJ9T5U4FeM6631r2bvAuGtmEd8zQaoTkFAtArTcMl/XQAEAAEAASUTY2xvdWRmbGFyZS1lc25pLmNvbQAA/g0AYwMAEABBBGGbUlGLuGRorUeFwmrgHImkrh9uxoPrnFKpS5bQvnc5grfMS3PvymQ2FYL02WQi1ZzZJg5OsYYdzlaGYnEoJNsABAABAAEqE2Nsb3VkZmxhcmUtZXNuaS5jb20AAA==";
```
likely benign LLM, confidence 0.95 Base64 ECHConfigList test constant for cloudflare-esni.com.
Reasoning
This is a base64 ECHConfigList constant for cloudflare-esni.com, the same ECH draft format, used as a test vector. The comment in the file indicates it is test data. Its length and structure are typical of a real config, not an encoded dropper.
info ~~warn~~ → info by review encoding-base64 rustls/tests/ech.rs:125:55

base64-like blob (352 bytes, compression ratio 0.77) (raw pass, confidence 0.60)
```
t BASE64_ECHCONFIG_LIST_WITH_UNSUPPORTED: &str = "AQW63QAFBQQDAgH+DQBmAAAQAEEE5itp4r9ln5e+Lx4NlIpM1Zdrt6keDUb73ampHp3culoB59aXqAoY+cPEox5W4nyDSNsWGhz1HX7xlC1Lz3IiwQAMAAEAAQABAAIAAQADQA5wdWJsaWMuZXhhbXBsZQAA/g0APQAAIAAgfWYWFXMCFK7ucFMzZvNqYJ6tZcDCCOYjIjRqtbzY3hwABBERIiJADnB1YmxpYy5leGFtcGxlAAD+DQBNAAAgACCFvWoDJ3wlQntS4m
```
likely benign LLM, confidence 0.94 Base64 ECHConfigList test constant with an unsupported version.
Reasoning
This is a base64 ECH config list containing an unsupported-version entry, used to test how the parser handles unknown versions. The name BASE64_ECHCONFIG_LIST_WITH_UNSUPPORTED makes the purpose clear. It is a deliberate test fixture in a tests/ file.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/rustls/rustls rustls && cd rustls
git checkout 2976d90fd1c2db6b518700dd101b714069cfcb17
disclude scan --severity info --diff 64ad386785c718c74262b79e6893813db381adfe rustls