CVE-2024-28854CWE-400

Slow loris vulnerability with default configuration in tls-listener

High · published March 15, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
61.6
In the wild
Unconfirmed
What it is

tls-listener is a rust lang wrapper around a connection listener to support TLS. With the default configuration of tls-listener, a malicious user can open 6.4 `TcpStream`s a second, sending 0 bytes, and can trigger a DoS. The default configuration options make any public service using `TlsListener::new()` vulnerable to a slow-loris DoS attack. This impacts any publicly accessible service using the default configuration of tls-listener in versions prior to 0.10.0. Users are advised to upgrade. Users unable to upgrade may mitigate this by passing a large value, such as `usize::MAX` as the parameter to `Builder::max_handshakes`.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00973 · 61.6th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2024-03-15T18:54Z
EPSS history
Timeline
  • 15 MAR 18:54Z
    Slow loris vulnerability with default configuration in tls-listener
    cvelistv5