https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 08 Nov 2026 20:46:10 +0000 https://db.gcve.eu/vuln/ghsa-w44r-93j7-qv28 <p><strong>Affected:</strong> crates.io: rustls</p> <p>## Summary</p> <p>The client records the server-selected key-exchange group per server name when it processes the ServerHello, before the server is authenticated. A network attacker can answer one connection attempt for a target name with a ServerHello that selects X25519 and close the connection. Later ClientHellos for that name carry one X25519 share while supported_groups still lists X25519MLKEM768 first. If the server accepts that share instead of sending a HelloRetryRequest, the handshake completes with classical key exchange only and no error.</p> <p>An attacker that answers one connection attempt for the target name with a ServerHello selecting X25519 changes every later ClientHello of that client for that name, for as long as the entry stays in the store. No certificate or completed handshake is needed: it parses the ClientHello, sends the ServerHello, and closes.</p> <p>TLS 1.3 transcript binding stops an on-path attacker from editing the ClientHello of one connection. It does not stop the attacker from steering the client&#39;s prediction state beforehand, because that state is written from an unauthenticated message.</p> <p>## What does not trigger it</p> <p>- Servers that send a HelloRetryRequest. The connection stays hybrid and costs one extra round trip. - A client configuration with resumption disabled: nothing is stored. - A different server name: the record is per name.</p> <p>## Impact</p> <p>If the genuine server picks the group for which a share is present, instead of sending a HelloRetryRequest for…</p> <p><strong>Affected:</strong> crates.io: rustls</p> <p>## Summary</p> <p>The client records the server-selected key-exchange group per server name when it processes the ServerHello, before the server is authenticated. A network attacker can answer one connection attempt for a target name with a ServerHello that selects X25519 and close the connection. Later ClientHellos for that name carry one X25519 share while supported_groups still lists X25519MLKEM768 first. If the server accepts that share instead of sending a HelloRetryRequest, the handshake completes with classical key exchange only and no error.</p> <p>An attacker that answers one connection attempt for the target name with a ServerHello selecting X25519 changes every later ClientHello of that client for that name, for as long as the entry stays in the store. No certificate or completed handshake is needed: it parses the ClientHello, sends the ServerHello, and closes.</p> <p>TLS 1.3 transcript binding stops an on-path attacker from editing the ClientHello of one connection. It does not stop the attacker from steering the client&#39;s prediction state beforehand, because that state is written from an unauthenticated message.</p> <p>## What does not trigger it</p> <p>- Servers that send a HelloRetryRequest. The connection stays hybrid and costs one extra round trip. - A client configuration with resumption disabled: nothing is stored. - A different server name: the record is per name.</p> <p>## Impact</p> <p>If the genuine server picks the group for which a share is present, instead of sending a HelloRetryRequest for…</p> https://db.gcve.eu/vuln/ghsa-w44r-93j7-qv28