AIKIDO-2026-659314

TL;DR

Rustls's handshake deframer tracks whether previously buffered handshake data is aligned, but the check only looked at whether the current fragment span was incomplete, not whether any pending handshake message, complete or partial, still remained. A peer that coalesces record layer messages could exploit that gap to have a handshake message processed at the wrong encryption level, letting content that should still require the negotiated handshake keys pass through as if it belonged to an earlier, unencrypted flow. The handshake transcript hash still binds every exchanged message, so an attacker cannot forge or complete a handshake this way, but rustls accepted improperly encrypted or misplaced messages that it should have rejected. The fix redefines alignment to require no pending handshake messages at all, closing the gap.