rustls EUVD-2026-119370

Exploitation requires that the rustls client store a per-server-name key-exchange prediction record - the advisory states that with resumption disabled nothing is stored and the attack does not trigger. The attacker must be able to answer one connection attempt for the exact target server name with a ServerHello selecting X25519 and close it (no certificate or completed handshake needed); the record is per-name, so a different server name is unaffected. The downgrade only completes if the GENUINE server then accepts the lone classical X25519 share instead of sending a HelloRetryRequest for its preferred hybrid group - the advisory calls this a server policy decision, and servers that issue a HelloRetryRequest stay hybrid and are not affected. Both peers must otherwise support the hybrid X25519MLKEM768 group. The high attack complexity and attack requirement (AC:H/AT:P) reflect these preconditions; the trigger is a protocol-state poisoning via an unauthenticated message as described, not a memory-corruption or timing bug.

This is a genuine but low-urgency issue, correctly deprioritized. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:L) scores 6.3 (Medium): network-reachable and unauthenticated, but with high attack complexity, a specific attack requirement (AT:P), and only limited confidentiality impact. Those tempering metrics are consistent with the advisory: exploitation does not compromise keys, bypass authentication, or raise an error - it silently strips post-quantum protection so recorded traffic is exposed only to a FUTURE quantum adversary (harvest-now-decrypt-later). No CISA KEV listing and no EPSS score are provided in the input, and no PoC or exploit code is referenced (only the GHSA advisory and patch commits), so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', not act_now/emergency, which aligns with the signals. Critically, the advisory itself states the real impact is 'largely down to a server policy decision' - a server that sends a HelloRetryRequest for its preferred hybrid group is not affected - so the realized risk is narrower than the network-vector metric alone suggests. No conflicting signals: all sources agree this is a downgrade/forward-secrecy-against-quantum concern, not an immediate confidentiality break.

An attacker positioned to answer a connection attempt for a target server name responds to one rustls client connection with a ServerHello selecting classical X25519, then closes. The poisoned per-name key-share prediction record causes that client's subsequent ClientHellos for the same name to carry only a classical X25519 share; if the genuine server accepts it instead of requesting the hybrid group, the handshake completes with classical-only key exchange and post-quantum confidentiality is silently lost for recorded sessions. No public exploit code is identified at time of analysis.