CVE-2024-32650

HIGH

rustls 0.21.0-0.21.10, 0.22.0-0.22.3, 0.23.0-0.23.4 - Denial of Service via Infinite Loop in complete_io

Title source: llm
STIX 2.1

Description

Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.

References (4)

Core 4

Scores

CVSS v3 7.5
EPSS 0.0095
EPSS Percentile 56.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-835
Status published
Products (5)
crates.io/rustls 0.23.0 - 0.23.5crates.io
rustls/rustls = 0.20.0
rustls/rustls >= 0.21.0, < 0.21.11
rustls/rustls >= 0.22.0, < 0.22.4
rustls/rustls >= 0.23.0, < 0.23.5
Published Apr 19, 2024
Tracked Since Feb 18, 2026