CVE-2024-32650CWE-835

Rustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client input

High · published April 19, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
60.8
In the wild
Unconfirmed
What it is

Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00949 · 60.8th percentile
Weakness
CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')
Published
2024-04-19T16:05Z
EPSS history
Timeline
  • 19 APR 16:05Z
    Rustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client input
    cvelistv5