CVE-2023-6180CWE-400CWE-404

Resource exhaustion via memory leak in tokio-boring

Medium · published December 5, 2023

CVSS v3.1
5.3
EPSS
1%
Percentile
49.0
In the wild
Unconfirmed
What it is

The tokio-boring library in version 4.0.0 is affected by a memory leak issue that can lead to excessive resource consumption and potential DoS by resource exhaustion. The set_ex_data function used by the library did not deallocate memory used by pre-existing data in memory each time after completing a TLS connection causing the program to consume more resources with each new connection.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00619 · 49.0th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-404 · Improper Resource Shutdown or Release
Published
2023-12-05T15:02Z
EPSS history
Timeline
  • 05 DEC 15:02Z
    Resource exhaustion via memory leak in tokio-boring
    cvelistv5