Vulnerability DatabaseCVE-2026-123611
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-123611
Published:November 08, 2026
Updated:November 09, 2026
rustls before 0.23.46 contains a key exchange downgrade vulnerability that allows network attackers to poison the per-server-name key-exchange group record via an unauthenticated ServerHello. Attackers can answer one connection with a ServerHello selecting X25519, causing later ClientHellos to send only classical shares and lose post-quantum confidentiality.
Affected Packages
https://github.com/rustls/rustls.git (GITHUB):
Affected version(s) >=v/0.5.4 <v/0.23.46 || =v/0.6.0 <v/0.23.46 || =v/0.7.0 <v/0.23.46 || =v/0.8.0 <v/0.23.46 || =v/0.9.0 <v/0.23.46 || =v/0.10.0 <v/0.23.46 || =v/0.11.0 <v/0.23.46 || =v/0.12.0 <v/0.23.46 || >=v/0.13.0 <v/0.23.46 || =v/0.14.0 <v/0.23.46 || >=v/0.15.0 <v/0.23.46 || =v/0.16.0 <v/0.23.46 || =v/0.17.0 <v/0.23.46 || >=v/0.18.0 <v/0.23.46 || >=v/0.19.0 <v/0.23.46 || >=v/0.20.0-beta1 <v/0.23.46 || >=v/0.21.0-alpha.1 <v/0.23.46 || >=v/0.22.0 <v/0.23.46 || >=v/0.23.0 <v/0.23.46
Fix Suggestion:
Update to version v/0.23.46
https://github.com/rustls/rustls.git (GITHUB):
Affected version(s) =v/0.24.0-alpha.1 <v/0.24.0-dev.2
Fix Suggestion:
Update to version v/0.24.0-dev.2
rustls (RUST):
Affected version(s) =0.9.0 <0.23.46 || >=0.19.0 <0.23.46 || =0.14.0 <0.23.46 || >=0.20.0-beta1 <0.23.46 || =0.12.0 <0.23.46 || =0.17.0 <0.23.46 || >=0.22.0-alpha.1 <0.23.46 || =0.16.0 <0.23.46 || =0.6.0 <0.23.46 || =0.10.0 <0.23.46 || >=0.5.4 <0.23.46 || =0.7.0 <0.23.46 || >=0.21.0-alpha.1 <0.23.46 || =0.8.0 <0.23.46 || >=0.23.0 <0.23.46 || >=0.18.0 <0.23.46 || =0.11.0 <0.23.46 || >=0.13.0 <0.23.46 || >=0.15.0 <0.23.46
Fix Suggestion:
Update to version 0.23.46
rustls (RUST):
Affected version(s) >=0.24.0-dev.0 <0.24.0-dev.2
Fix Suggestion:
Update to version 0.24.0-dev.2
Related Resources (11)
https://rustsec.org/advisories/RUSTSEC-2026-0349.html
https://github.com/rustls/rustls/pull/3355
https://nvd.nist.gov/vuln/detail/CVE-2026-123611
https://crates.io/crates/rustls
https://github.com/rustls/rustls/commit/f04804fa13341a9b1dc02b5d1dd8a746f2c4b7fb
https://github.com/rustls/rustls/commit/8fa0dc5d517a63411ad1e528249bdf5b098ae5e4
https://github.com/rustls/rustls/releases/tag/v/0.23.46
https://www.vulncheck.com/advisories/rustls-before-0.23.46-key-exchange-downgrade-via-unauthenticated-serverhello
https://github.com/rustls/rustls/security/advisories/GHSA-w44r-93j7-qv28
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123611.json
https://github.com/rustls/rustls
Do you need more information?
Contact Us
CVSS v4
Base Score:
6.3
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
PRESENT
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
NONE
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
3.7
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE
Weakness Type (CWE)
Selection of Less-Secure Algorithm During Negotiation
CWE-757
EPSS
Base Score:
0.19