Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2024-32650

Rustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client input

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

rustls rustls

  • >= 0.23.0, < 0.23.5affected
  • >= 0.22.0, < 0.22.4affected
  • >= 0.21.0, < 0.21.11affected
  • = 0.20.0affected

References