{"id":"ghsa-ghsa-w44r-93j7-qv28","seq":1708775,"kind":"advisory","title":"rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share","url":"https://github.com/advisories/GHSA-w44r-93j7-qv28","permalink":"https://vulnpulse.app/items/ghsa-ghsa-w44r-93j7-qv28","summary":"影響: rust:rustls < 0.23.46 → 0.23.46, rust:rustls >= 0.24.0-dev.1, < 0.24.0-dev.2 → 0.24.0-dev.2\nThe client records the server-selected key-exchange group per server name when it processes the ServerHello, before the server is authenticated. A network attacker can answer one connection attempt for a target name with a ServerHello that selects X25519 and close the connection. Later ClientHellos for that name carry one X25519 share while supported_groups still lists X25519MLKEM768 first. If the server accepts that share instead of sending a HelloRetryRequest, the handshake completes with cla…","severity":"low","techs":["rust"],"cves":[],"tags":["GHSA-w44r-93j7-qv28","rustls","rustls"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T16:08:54.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}