{"id":"CVE-2026-123611","kind":"vulnerability","aliases":["CVE-2026-123611"],"related":[],"title":"rustls: forged ServerHello can strip post-quantum key exchange from later connections","description":"rustls before 0.23.46 contains a key exchange downgrade vulnerability that allows network attackers to poison the per-server-name key-exchange group record via an unauthenticated ServerHello. Attackers can answer one connection with a ServerHello selecting X25519, causing later ClientHellos to send only classical shares and lose post-quantum confidentiality.","summary":"rustls is a TLS library for Rust programs. A network attacker can answer one connection with a forged ServerHello that selects X25519, which makes rustls remember a classical-only key exchange for that server name and send only classical key shares on later connections, losing post-quantum confidentiality.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","post-quantum","rust","rustls","tls"],"not_affected_if":["no-post-quantum-kx","tls-server-only"],"how_to_check":"- Find rustls in the Cargo.lock file of each Rust project, for example `grep -A1 'name = \"rustls\"' Cargo.lock`\n- Check the rustls version listed against the fixed version below","fix":"- rustls: upgrade to `0.23.46` or later","status":"open","published_at":"2026-11-08T02:16:56+00:00","first_seen_at":"2026-11-08T02:21:14+00:00","triaged_at":"2026-11-08T02:24:52+00:00","updated_at":"2026-11-08T02:24:52+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T02:24:52Z","model":"claude-haiku-5-5","output":{"fix":"- rustls: upgrade to `0.23.46` or later","reach":"network","title":"rustls: forged ServerHello can strip post-quantum key exchange from later connections","impact":"low","summary":"rustls is a TLS library for Rust programs. A network attacker can answer one connection with a forged ServerHello that selects X25519, which makes rustls remember a classical-only key exchange for that server name and send only classical key shares on later connections, losing post-quantum confidentiality.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","rustls","tls","post-quantum"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"later connections to a server lose post-quantum key exchange protection","analyst_note":"","how_to_check":"- Find rustls in the Cargo.lock file of each Rust project, for example `grep -A1 'name = \"rustls\"' Cargo.lock`\n- Check the rustls version listed against the fixed version below","plain_action":"","needs_analyst":false,"not_affected_if":["no-post-quantum-kx","tls-server-only"],"who_is_affected":"Rust programs that use rustls as a TLS client and rely on post-quantum hybrid key exchange to a server name are exposed. An attacker must be on the network path to the connection and can only downgrade later connections to classical key exchange, not read the data of the forged connection. Programs that do not use post-quantum key exchange, or only act as TLS servers, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000706,"input_tokens":4284,"output_tokens":555,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123611':16A,19A '-2026':15A,18A '0.23.46':79C 'allow':87C 'answer':39B,108C 'attack':37B,89C,106C 'caus':116C 'classic':55B,66B,122C 'classical-on':54B 'clienthello':118C 'confidenti':76B,129C 'connect':13A,41B,71B,110C 'contain':80C 'cve':14A,17A 'downgrad':84C 'exchang':10A,58B,83C,99C 'forg':2A,44B 'group':100C 'key':9A,57B,67B,82C,98C 'key-exchang':97C 'later':12A,70B,117C 'librari':31B 'lose':72B,125C 'make':50B 'name':62B,96C 'network':36B,88C 'one':40B,109C 'packag':20B 'per':94C 'per-server-nam':93C 'poison':91C 'post':7A,22B,74B,127C 'post-quantum':6A,21B,73B,126C 'program':34B 'quantum':8A,23B,75B,128C 'record':101C 'rememb':52B 'rust':24B,33B 'rustl':1A,25B,27B,51B,77C 'select':47B,114C 'send':64B,120C 'server':61B,95C 'serverhello':3A,45B,105C,113C 'share':68B,123C 'strip':5A 'tls':26B,30B 'unauthent':104C 'via':102C 'vulner':85C 'x25519':48B,115C","nicknames":[],"mitigations":[],"who_affected":"Rust programs that use rustls as a TLS client and rely on post-quantum hybrid key exchange to a server name are exposed. An attacker must be on the network path to the connection and can only downgrade later connections to classical key exchange, not read the data of the forged connection. Programs that do not use post-quantum key exchange, or only act as TLS servers, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","postquantum","rust","rustls","tls"],"campaign_type":null,"search_a":"'-123611':16A,19A '-2026':15A,18A 'connect':13A 'cve':14A,17A 'exchang':10A 'forg':2A 'key':9A 'later':12A 'post':7A 'post-quantum':6A 'quantum':8A 'rustl':1A 'serverhello':3A 'strip':5A","search_b":"'answer':39B 'attack':37B 'classic':55B,66B 'classical-on':54B 'confidenti':76B 'connect':41B,71B 'exchang':58B 'forg':44B 'key':57B,67B 'later':70B 'librari':31B 'lose':72B 'make':50B 'name':62B 'network':36B 'one':40B 'packag':20B 'post':22B,74B 'post-quantum':21B,73B 'program':34B 'quantum':23B,75B 'rememb':52B 'rust':24B,33B 'rustl':25B,27B,51B 'select':47B 'send':64B 'server':61B 'serverhello':45B 'share':68B 'tls':26B,30B 'x25519':48B","search_c":"'0.23.46':79C 'allow':87C 'answer':108C 'attack':89C,106C 'caus':116C 'classic':122C 'clienthello':118C 'confidenti':129C 'connect':110C 'contain':80C 'downgrad':84C 'exchang':83C,99C 'group':100C 'key':82C,98C 'key-exchang':97C 'later':117C 'lose':125C 'name':96C 'network':88C 'one':109C 'per':94C 'per-server-nam':93C 'poison':91C 'post':127C 'post-quantum':126C 'quantum':128C 'record':101C 'rustl':77C 'select':114C 'send':120C 'server':95C 'serverhello':105C,113C 'share':123C 'unauthent':104C 'via':102C 'vulner':85C 'x25519':115C","first_public_at":"2026-10-14T09:55:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123611","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123611","severity":null,"published_at":"2026-11-08T02:16:56+00:00","modified_at":"2026-11-08T02:16:56+00:00","first_seen_at":"2026-11-08T02:21:14+00:00","fetched_at":"2026-11-08T02:21:14+00:00","note":null}],"documents":[{"id":99373,"url":"https://github.com/rustls/rustls/security/advisories/GHSA-w44r-93j7-qv28","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-14T09:55:05+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99374,"url":"https://www.vulncheck.com/advisories/rustls-before-0.23.46-key-exchange-downgrade-via-unauthenticated-serverhello","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}