RUSTSEC-2026-0349 Unauthenticated ServerHello can downgrade later connections to classical key exchange

The client recorded the server-selected key exchange group for each server name when processing the ServerHello, before the server was authenticated. This record is used to predict which key share to send in future ClientHellos to that server name. A network attacker can answer one connection...