GHSA-4v43-5ff7-45w4: 
Rust vulnerability analysis and mitigation

Found in an internal audit on 2026-10-21. Fixed in 0.2.0-preview.5; upgrade to it.

What was found (up to 0.2.0-preview.4)

1. SNI is not checked on tunnels Kule doesn't look inside. network::relay returns the raw tunnel when interceptor.wants() is false; the ClientHello's SNI is never compared with the CONNECT host. Hosts the default policy lets through with no question (static.rust-lang.org, api.nuget.org, globalcdn.nuget.org, repo.maven.apache.org, repo1.maven.org) sit on shared CDNs that route by SNI, so CONNECT repo1.maven.org:443 + SNI of another CDN customer reaches that customer. Same for approved git hosts and profile-opened hosts without a key. (Code path confirmed; CDN behaviour not tested.)
2. The foreign-credential check is a deny-list (crates/kule-engine/src/secrets.rs foreign_credential, foreign_in_form):
   • Basic auth passes when either side is Kule's: Basic base64("<placeholder>:<other token>") passes and fill keeps the other token, so git/REST can authenticate as another account.
   • Query names are a fixed list; GitLab private_token/job_token and the JOB-TOKEN header are missing.
   • Only urlencoded bodies are checked (tls.rs); JSON and multipart bodies are not.
3. Hardening on the same path:
   • public_ip misses 6to4 2002::/16, Teredo 2001::/32, 64:ff9b:1::/48, 100::/64 (embedded IPv4). Prefer allowing only 2000::/3 and decoding embedded IPv4.
   • Hosts with a trailing dot are judged and matched by wants() without normalising, so a remembered/approved host. skips the inside checks.
   • Content-Length accepts +5 (u64::from_str).
   • Response blanking covers raw, JSON-escaped and upper-case %XX only; not base64, lower-case %xx, \uXXXX, or values split by chunk framing. Range to vault hosts can return fragments.

Fix

Fixed in 0.2.0-preview.5.

• Tunnels Kule does not look inside: the client's first bytes are read before any reach the host. Kule needs a TLS hello that asks for exactly the CONNECT host (in lower case, without a trailing dot), or no name when the host is an address. It refuses an Encrypted Client Hello or ESNI extension and duplicate extensions. Only TLS goes on port 443; on other ports, non-TLS (ssh) still passes. What the host sends flows back from the start, so protocols where the server speaks first keep working. A refused tunnel is logged with outcome cut and a reason.
• Plain http://: lonca-net 3a4e015 adds Gate::relay_plain, and Kule now serves each request on the connection itself. Each request must name the host and port it was let through to, in the request line and in Host; the post-connect address check also applies.
• Hosts Kule holds a secret for:
  • A credential is recognised by name rather than by a fixed list, in headers, query parameters and form, JSON (top level and nested objects) and multipart fields. A credential is a name with the words token, key, secret, password, auth, credential, jwt or bearer, in any spelling, apart from a few known non-credentials such as pageToken or Idempotency-Key. Such a field may only hold Kule's placeholder.
  • Basic is accepted only as <any user>:<placeholder>, <placeholder>: or <placeholder>:x-oauth-basic.
  • Bodies with fields are read whole up to 1 MB. A body that is too large, chunked or unreadable is refused.
  • Range and If-Range are stripped.
  • Responses are de-chunked before blanking and re-framed. Blanking also covers lower-case %xx, full \uXXXX escapes, and base64/base64url at every alignment.
• Hardening:
  • IPv6 counts as public only in 2000::/3, less 2001::/23, documentation ranges and 6to4 (judged by its IPv4).
  • Host names are normalised before the policy, the question to the person and the interceptor see them.
  • Content-Length must be digits only.

Tests (seen failing first)

• a_tunnel_whose_tls_asks_for_another_host_is_cut, a_plain_request_for_another_host_never_reaches_it (real proxy, local upstream, a rustls ClientHello).
• a_tunnel_goes_on_only_where_its_hello_asks_for_its_host, the_name_a_hello_asks_for_is_read_however_it_comes, a_hidden_name_or_a_hello_that_does_not_read_is_told, a_plain_request_names_its_own_host_or_none.
• a_secret_goes_into_credential_headers_alone (Basic {p}:sk-other, ghp_other:, JOB-TOKEN, ?private_token=, ?job_token=), a_json_or_multipart_body_with_credentials_kule_does_not_hold_is_refused, a_form_with_credentials_kule_does_not_hold_is_refused.
• a_host_kule_fills_for_is_known_by_any_spelling_and_sent_no_range, a_secret_split_between_chunks_is_blanked, a_secret_in_base64_is_found_however_it_lines_up.
• addresses_on_this_computer_or_its_network_are_not_public (2002:7f00:1::, Teredo of 127.0.0.1, 64:ff9b:1::, 100::), a_request_two_readers_could_frame_apart_is_refused (Content-Length: +5).
• 18 of 18 mutations, one per guard, caught.

Workaround

Upgrade to 0.2.0-preview.5. On an older version, allow only hosts that do not sit behind a shared front, and do not keep secrets in Kule for hosts where an agent could use an account of its own.