rustls before 0.23.46 contains a key‑exchange downgrade flaw that lets an attacker send an unauthenticated ServerHello selecting the X25519 group. The client then records this group for future handshakes, causing later ClientHellos to omit post‑quantum shares and losing post‑quantum confidentiality. The impact is the ability to downgrade a TLS session from post‑quantum‑secure to classical only, potentially exposing confidential data. The flaw is a classic downgrade attack where the adversary can inject an unauthorized ServerHello. This is a post‑quantum downgrade that compromises the intended security guarantees.

All Rust programs using rustls versions older than 0.23.46 are vulnerable. The vulnerability affects the rustls library shipped before version 0.23.46. Users running any of those releases must upgrade to protect against potential downgrade attacks.

The CVSS score of 6.3 indicates moderate‑to‑high severity. EPSS is not available, and the vulnerability is not listed in KEV, suggesting limited, but non‑zero, exploitation potential. An attacker who can reach the server and send a forged ServerHello can trigger the downgrade without authentication, making the vulnerability easy to exploit from the network. Given the medium CVSS score and lack of mitigation, the overall risk is considered moderate to high for exposed systems.