MEDIUM 6.3 NVD
CVE-2026-123611
rustls before 0.23.46 contains a key exchange downgrade vulnerability that allows network attackers to poison the per-server-name key-exchange group record via
rustls before 0.23.46 contains a key exchange downgrade vulnerability that allows network attackers to poison the per-server-name key-exchange group record via an unauthenticated ServerHello. Attackers can answer one connection with a ServerHello selecting X25519, causing later ClientHellos to send only classical shares and lose post-quantum confidentiality.
References
- https://github.com/rustls/rustls/security/advisories/GHSA-w44r-93j7-qv28
- https://www.vulncheck.com/advisories/rustls-before-0.23.46-key-exchange-downgrade-via-unau
This medium severity vulnerability with a CVSS score of 6.3 was published on 2026-11-08 via NVD.
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.