rustls 0.23.46

Source: https://github.com/rustls/rustls
Artifact scanned: rustls-0.23.46.crate (crate · 377.2 KB · SHA-256 48e13bd8c0e9…)
Compared with: rustls-0.23.45.crate (0 signals introduced since)
Files: 111 scanned, 8 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 10 info
Scan time: 6.9 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 10 of 10 warn and critical signals; 10 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-24 04:30

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review encoding-hex src/crypto/tls12.rs:99:24

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
    fn check_sha256() {
        let secret = b"\x9b\xbe\x43\x6b\xa9\x40\xf0\x17\xb1\x76\x52\x84\x9a\x71\xdb\x35";
        let seed = b"\xa0\xba\x9f\x93\x6c\xda\x31\x18\x27\xa6\xf7\x96\xff\xd5\x19\x8c";
        let label = b"test label";
```
likely benign LLM, confidence 0.95 Test vector bytes for TLS 1.2 PRF SHA-256 check.
Reasoning
Hex byte literals inside a test function for TLS PRF known-answer vectors (secret, seed, label, expected output loaded from testdata). Standard cryptographic test data; no execution or obfuscated payload.
info ~~warn~~ → info by review encoding-hex src/crypto/tls12.rs:100:22

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
        let secret = b"\x9b\xbe\x43\x6b\xa9\x40\xf0\x17\xb1\x76\x52\x84\x9a\x71\xdb\x35";
        let seed = b"\xa0\xba\x9f\x93\x6c\xda\x31\x18\x27\xa6\xf7\x96\xff\xd5\x19\x8c";
        let label = b"test label";
        let expect = include_bytes!("../testdata/prf-result.1.bin");
```
likely benign LLM, confidence 0.95 Test vector bytes for TLS 1.2 PRF SHA-256 check.
Reasoning
Same test-vector byte string continuation in the PRF known-answer test; expected output is from a testdata file. Benign.
info ~~warn~~ → info by review encoding-hex src/crypto/tls12.rs:117:24

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
    fn check_sha512() {
        let secret = b"\xb0\x32\x35\x23\xc1\x85\x35\x99\x58\x4d\x88\x56\x8b\xbb\x05\xeb";
        let seed = b"\xd4\x64\x0e\x12\xe4\xbc\xdb\xfb\x43\x7f\x03\xe6\xae\x41\x8e\xe5";
        let label = b"test label";
```
likely benign LLM, confidence 0.95 Test vector bytes for TLS 1.2 PRF SHA-512 check.
Reasoning
Known-answer test inputs for SHA-512 PRF in a unit test; hex escapes are normal for binary test data.

info ~~warn~~ → info by review encoding-hex src/crypto/tls12.rs:118:22

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)

        let secret = b"\xb0\x32\x35\x23\xc1\x85\x35\x99\x58\x4d\x88\x56\x8b\xbb\x05\xeb";
        let seed = b"\xd4\x64\x0e\x12\xe4\xbc\xdb\xfb\x43\x7f\x03\xe6\xae\x41\x8e\xe5";
        let label = b"test label";
        let expect = include_bytes!("../testdata/prf-result.2.bin");

likely benign LLM, confidence 0.95 Test vector bytes for TLS 1.2 PRF SHA-512 check.

Reasoning

Continuation of the SHA-512 PRF test vectors with expected output from testdata. Benign.

info ~~warn~~ → info by review encoding-hex src/crypto/tls12.rs:135:24

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
    fn check_sha384() {
        let secret = b"\xb8\x0b\x73\x3d\x6c\xee\xfc\xdc\x71\x56\x6e\xa4\x8e\x55\x67\xdf";
        let seed = b"\xcd\x66\x5c\xf6\xa8\x44\x7d\xd6\xff\x8b\x27\x55\x5e\xdb\x74\x65";
        let label = b"test label";
```
likely benign LLM, confidence 0.95 Test vector bytes for TLS 1.2 PRF SHA-384 check.
Reasoning
Known-answer test inputs for SHA-384 PRF in a unit test; standard for crypto libraries.

info ~~warn~~ → info by review encoding-hex src/crypto/tls12.rs:136:22

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)

        let secret = b"\xb8\x0b\x73\x3d\x6c\xee\xfc\xdc\x71\x56\x6e\xa4\x8e\x55\x67\xdf";
        let seed = b"\xcd\x66\x5c\xf6\xa8\x44\x7d\xd6\xff\x8b\x27\x55\x5e\xdb\x74\x65";
        let label = b"test label";
        let expect = include_bytes!("../testdata/prf-result.3.bin");

likely benign LLM, confidence 0.95 Test vector bytes for TLS 1.2 PRF SHA-384 check.

Reasoning

Continuation of SHA-384 PRF test vectors referencing testdata output. Benign.

info ~~warn~~ → info by review encoding-hex src/msgs/message_test.rs:58:9

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
        \x16\x03\x01\x00\xeb\x01\x00\x00\xe7\x03\x03\xb6\x1f\xe4\x3a\x55\
        \x90\x3e\xc0\x28\x9c\x12\xe0\x5c\x84\xea\x90\x1b\xfb\x11\xfc\xbd\
        \x25\x55\xda\x9f\x51\x93\x1b\x8d\x92\x66\xfd\x00\x00\x2e\xc0\x2c\
        \xc0\x2b\xc0\x24\xc0\x23\xc0\x0a\xc0\x09\xcc\xa9\xc0\x30\xc0\x2f\
```
likely benign LLM, confidence 0.93 Captured TLS ClientHello bytes used as a message parsing test fixture.
Reasoning
A raw TLS ClientHello byte sequence used as a parser test fixture (cipher suites, random bytes). Protocol captures in message tests are expected; no execution or hidden payload.
info ~~warn~~ → info by review encoding-hex src/msgs/message_test.rs:59:9

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
        \x90\x3e\xc0\x28\x9c\x12\xe0\x5c\x84\xea\x90\x1b\xfb\x11\xfc\xbd\
        \x25\x55\xda\x9f\x51\x93\x1b\x8d\x92\x66\xfd\x00\x00\x2e\xc0\x2c\
        \xc0\x2b\xc0\x24\xc0\x23\xc0\x0a\xc0\x09\xcc\xa9\xc0\x30\xc0\x2f\
        \xc0\x28\xc0\x27\xc0\x14\xc0\x13\xcc\xa8\x00\x9d\x00\x9c\x00\x3d\
```
likely benign LLM, confidence 0.93 Captured TLS ClientHello bytes used as a message parsing test fixture.
Reasoning
Continuation of the TLS ClientHello test fixture byte literal with cipher suite lists. Benign.
info ~~warn~~ → info by review encoding-hex src/msgs/message_test.rs:69:9

16 consecutive `\xNN` escapes (entropy 3.5 bits/byte) (raw pass, confidence 0.65)
```
        \x32\x05\x68\x32\x2d\x31\x36\x05\x68\x32\x2d\x31\x35\x05\x68\x32\
        \x2d\x31\x34\x08\x73\x70\x64\x79\x2f\x33\x2e\x31\x06\x73\x70\x64\
        \x79\x2f\x33\x08\x68\x74\x74\x70\x2f\x31\x2e\x31\x00\x0b\x00\x02\
        \x01\x00\x00\x0a\x00\x0a\x00\x08\x00\x1d\x00\x17\x00\x18\x00\x19";
```
likely benign LLM, confidence 0.93 Captured TLS ClientHello extension bytes used as a parser test fixture.
Reasoning
Remaining ClientHello fixture bytes including ALPN and extension data (spdy, http/1.1). Consistent with a real handshake capture for a parser test.
info ~~warn~~ → info by review encoding-hex src/msgs/message_test.rs:70:9

16 consecutive `\xNN` escapes (entropy 3.5 bits/byte) (raw pass, confidence 0.65)
```
        \x2d\x31\x34\x08\x73\x70\x64\x79\x2f\x33\x2e\x31\x06\x73\x70\x64\
        \x79\x2f\x33\x08\x68\x74\x74\x70\x2f\x31\x2e\x31\x00\x0b\x00\x02\
        \x01\x00\x00\x0a\x00\x0a\x00\x08\x00\x1d\x00\x17\x00\x18\x00\x19";
    let mut rd = Reader::init(bytes);
```
likely benign LLM, confidence 0.93 Captured TLS ClientHello extension bytes used as a parser test fixture.
Reasoning
Final portion of the ClientHello fixture feeding a Reader in a test. Benign protocol test data.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o rustls-0.23.46.crate 'https://static.crates.io/crates/rustls/rustls-0%2E23%2E46.crate'
printf '%s  %s\n' 48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf rustls-0.23.46.crate | shasum -a 256 -c -
mkdir pkg && tar -xzf rustls-0.23.46.crate -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg