DEBIAN-CVE-2026-123611

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-123611
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-123611.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-123611
Upstream
Published
2026-11-08T02:16:56Z
Modified
2026-11-08T10:00:15Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
[none]
Details

rustls before 0.23.46 contains a key exchange downgrade vulnerability that allows network attackers to poison the per-server-name key-exchange group record via an unauthenticated ServerHello. Attackers can answer one connection with a ServerHello selecting X25519, causing later ClientHellos to send only classical shares and lose post-quantum confidentiality.

References

Affected packages

Debian:12 / rust-rustls

Package

Name
rust-rustls
Purl
pkg:deb/debian/rust-rustls?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.20.8-4
0.20.8-4.1
0.20.8-4.2
0.21.5-1
0.21.5-2
0.21.5-3
0.21.5-4
0.21.5-5
0.21.6-1
0.21.6-2
0.21.6-3
0.21.6-4
0.21.7-1
0.21.8-1
0.21.8-2
0.21.8-3
0.21.8-3.1
0.21.9-1
0.21.10-1
0.21.12-1
0.21.12-2
0.21.12-3
0.21.12-4
0.21.12-5
0.21.12-6
0.21.12-7
0.21.12-8
0.21.12-9
0.23.16-1
0.23.20+ds-1
0.23.20+ds-2
0.23.20+ds-3
0.23.20+ds-4
0.23.20+ds-5
0.23.20+ds-6
0.23.20+ds-7
0.23.20+ds-8
0.23.20+ds-9
0.23.20+ds-10
0.23.25+ds-1
0.23.26+ds-1
0.23.31+ds-1
0.23.31+ds-2
0.23.31+ds-3
0.23.31+ds-4
0.23.31+ds-5
0.23.31+ds-6
0.23.31+ds-7
0.23.32+ds-1
0.23.32+ds-2
0.23.33+ds-1
0.23.33+ds-2
0.23.33+ds-3
0.23.33+ds-4
0.23.35+ds-1
0.23.36+ds-1
0.23.37+ds-1
0.23.37+ds-2
0.23.37+ds-3
0.23.38+ds-1
0.23.40+ds-1
0.23.41+ds-1
0.23.43+ds-1
0.23.45+ds-1
0.23.46+ds-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-123611.json"

Debian:13 / rust-rustls

Package

Name
rust-rustls
Purl
pkg:deb/debian/rust-rustls?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.23.26+ds-1
0.23.31+ds-1
0.23.31+ds-2
0.23.31+ds-3
0.23.31+ds-4
0.23.31+ds-5
0.23.31+ds-6
0.23.31+ds-7
0.23.32+ds-1
0.23.32+ds-2
0.23.33+ds-1
0.23.33+ds-2
0.23.33+ds-3
0.23.33+ds-4
0.23.35+ds-1
0.23.36+ds-1
0.23.37+ds-1
0.23.37+ds-2
0.23.37+ds-3
0.23.38+ds-1
0.23.40+ds-1
0.23.41+ds-1
0.23.43+ds-1
0.23.45+ds-1
0.23.46+ds-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-123611.json"

Debian:14 / rust-rustls

Package

Name
rust-rustls
Purl
pkg:deb/debian/rust-rustls?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.23.26+ds-1
0.23.31+ds-1
0.23.31+ds-2
0.23.31+ds-3
0.23.31+ds-4
0.23.31+ds-5
0.23.31+ds-6
0.23.31+ds-7
0.23.32+ds-1
0.23.32+ds-2
0.23.33+ds-1
0.23.33+ds-2
0.23.33+ds-3
0.23.33+ds-4
0.23.35+ds-1
0.23.36+ds-1
0.23.37+ds-1
0.23.37+ds-2
0.23.37+ds-3
0.23.38+ds-1
0.23.40+ds-1
0.23.41+ds-1
0.23.43+ds-1
0.23.45+ds-1
0.23.46+ds-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-123611.json"