rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

GHSA-w44r-93j7-qv28

RUSTSEC-2026-0349

osv · GHSA-w44r-93j7-qv28

• https://github.com/rustls/rustls/security/advisories/GHSA-w44r-93j7-qv28
• https://github.com/rustls/rustls/pull/3355
• https://github.com/rustls/rustls/commit/8fa0dc5d517a63411ad1e528249bdf5b098ae5e4
• https://github.com/rustls/rustls/commit/f04804fa13341a9b1dc02b5d1dd8a746f2c4b7fb
• https://github.com/rustls/rustls
• https://github.com/rustls/rustls/releases/tag/v/0.23.46
• https://rustsec.org/advisories/RUSTSEC-2026-0349.html

osv · RUSTSEC-2026-0349

• https://crates.io/crates/rustls
• https://rustsec.org/advisories/RUSTSEC-2026-0349.html
• https://github.com/rustls/rustls/pull/3355

No related operational record is retained in the current change model.