RUSTSEC-2026-0349: Unauthenticated ServerHello can downgrade later connections to classical key exchange
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 15/100
Research direction
The vulnerable dependency is rustls 0.23.45, so start with Cargo.toml and Cargo.lock to see where rustls is pulled in. Pull request #586 is already open against this issue, so check whether it bumps rustls to 0.23.46 or later before doing any work. Done means the lockfile resolves to a patched rustls and the advisory no longer shows up in a cargo audit run.
Written by the indexing model from the issue text.
Description
Unauthenticated ServerHello can downgrade later connections to classical key exchange
| Details | |
|---|---|
| Package | rustls |
| Version | 0.23.45 |
| URL | https://github.com/rustls/rustls/pull/3355 |
| Date | 2026-10-14 |
| Patched versions | >=0.23.46 |
The client recorded the server-selected key exchange group for each server
name when processing the ServerHello, before the server was authenticated.
This record is used to predict which key share to send in future ClientHellos
to that server name.
A network attacker can answer one connection attempt with a ServerHello
selecting X25519, and then close the connection. Later ClientHellos for that
name carry only an X25519 key share, while supported_groups still lists
X25519MLKEM768 first. If the genuine server accepts that share rather than
sending a HelloRetryRequest for its preferred hybrid group, the handshake
completes with classical-only key exchange and no error. This persists for as
long as the entry stays in the client's session store.
The impact is loss of post-quantum confidentiality for affected connections
("harvest now, decrypt later"). There is no key compromise and no
authentication bypass.
The following are not affected:
- connections to servers which send a HelloRetryRequest for their preferred group,
- clients with resumption disabled (as nothing is stored), and
- other server names.
This behaviour is discussed in
draft-ietf-tls-key-share-prediction,
so the practical impact depends largely on server policy.
See advisory page for additional details.
- Dominant language
- Rust
- Stars
- 460
- Forks
- 37
- Avg merge
- 2d 16h
- Merged PRs (30d)
- 6
Getting set up
Starts the project's dev container in your browser, under your own GitHub account.
- No Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from esp-rs/espup
-
RUSTSEC-2026-0346: `Debug` impls for client session values expose TLS secretsPossibly taken @SergioGasquez claimed this 2 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 45/100
-
RUSTSEC-2026-0348: Brotli certificate decompression can allocate up to 1 GiB before authenticationPossibly taken @SergioGasquez claimed this 2 days ago. Open
Difficulty 2/5 Under an hour Newbie friendliness 25/100
-
RUSTSEC-2026-0347: Buffered application data sent to outer server after ECH rejectionPossibly taken @SergioGasquez claimed this 2 days ago. Open
Difficulty 2/5 Under an hour Newbie friendliness 15/100
-
Difficulty 4/5 3-5 days Newbie friendliness 30/100
-
enhancement feature request
Difficulty 4/5 3-5 days Newbie friendliness 35/100
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
pop-os/cosmic-comp#2956 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
libp2p/rust-libp2p#6694 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
EmbarkStudios/cargo-deny#910 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
tursodatabase/turso#10054 ·
Maintainers usually reply within 1 day
-
build: Update rust versionPossibly taken A pull request linked to this issue is open or already merged. Opendependencies
Difficulty 2/5 1-3 hours Newbie friendliness 67/100
ibm-granite-community/granite-cli#229 ·
Maintainers usually reply within 1 day