CVE-2026-123611 · Package
NO FIX YET · SEE WHAT TO DO
rustls is a TLS library for Rust programs. A network attacker can answer one connection with a forged ServerHello that selects X25519, which makes rustls remember a classical-only key exchange for that server name and send only classical key shares on later connections, losing post-quantum confidentiality.
first public Oct 14, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Rust programs that use rustls as a TLS client and rely on post-quantum hybrid key exchange to a server name are exposed. An attacker must be on the network path to the connection and can only downgrade later connections to classical key exchange, not read the data of the forged connection. Programs that do not use post-quantum key exchange, or only act as TLS servers, can skip it.
Not affected if no-post-quantum-kx, tls-server-only
Who cares post-quantum, rust, rustls, tls
grep -A1 'name = "rustls"' Cargo.lock0.23.46 or laterrustls before 0.23.46 contains a key exchange downgrade vulnerability that allows network attackers to poison the per-server-name key-exchange group record via an unauthenticated ServerHello. Attackers can answer one connection with a ServerHello selecting X25519, causing later ClientHellos to send only classical shares and lose post-quantum confidentiality.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.