Zero Radar
← feed
LowVulnerabilityGHSA-w44r-93j7-qv28updated 27 Oct 2026, 16:09 UTC

rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical…

Fixed in rustls 0.23.46, rustls 0.24.0-dev.2Official source
SeverityLowCVSS 3.7 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesrustls 0.23.46, rustls 0.24.0-dev.2 · since 27 Oct 2026
How sure is this?Official sourceBacked by an official source

Are you affected?

Package / productAffected versionsFixed in
rustls · rust< 0.23.460.23.46
rustls · rust>= 0.24.0-dev.1, < 0.24.0-dev.20.24.0-dev.2

Timeline

  1. 27 Oct 2026, 16:08 UTC
    Publicly disclosed
  2. 27 Oct 2026, 16:08 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 27 Oct 2026, 16:09 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
GHSA-w44r-93j7-qv28
CVSS
3.7 / 10
Disclosed
27 Oct 2026, 16:08 UTC
On Zero Radar
27 Oct 2026, 16:09 UTC (1 min after disclosure)
Last change
27 Oct 2026, 16:09 UTC

This entry has not been explained yet. The text comes straight from the source. How Zero Radar works

rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical… · Zero Radar