rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share

影響: rust:rustls < 0.23.46 → 0.23.46, rust:rustls >= 0.24.0-dev.1, < 0.24.0-dev.2 → 0.24.0-dev.2

The client records the server-selected key-exchange group per server name when it processes the ServerHello, before the server is authenticated. A network attacker can answer one connection attempt for a target name with a ServerHello that selects X25519 and close the connection. Later ClientHellos for that name carry one X25519 share while supported_groups still lists X25519MLKEM768 first. If the server accepts that share instead of sending a HelloRetryRequest, the handshake completes with cla…

GitHub Advisory Database에서 읽기

2026. 10. 28. 오전 01:08, GitHub Advisory Database에서 "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "낮음"(low)입니다. 관련 기술: Rust.