CVE-2026-123612: Security vulnerability

rustls 0.23.44 and 0.23.45 contain an information disclosure vulnerability that sends application data buffered before the handshake completes to the client-facing server when Encrypted Client Hello is rejected. Because starttraffic() queues plaintext from ClientConnection::writer() before sending the echrequired alert, the authenticated publicname server receives data intended for the inner server.