Invalid curve attack
An attack on elliptic-curve key exchange that works when a server accepts points that do not lie on the intended curve.
The idea appeared in 2000, in a paper on fault attacks against elliptic-curve systems, and became practical when many implementations were careless about validating the public keys they received. If the server does not check that a received point is on the curve, the attacker can send a point on a different, weaker curve. There the private scalar is multiplied by a point of small order, so each response leaks the scalar modulo a small prime. With enough queries the Chinese Remainder Theorem rebuilds the whole key.
The fix is simple: check every received point against the curve equation and confirm it lies in the correct subgroup. Cryptography rarely fails in the mathematics, but it fails in the validation often enough.