CVE-2024-32650

2024-04-1916:15:10

Google

osv.dev

rustls

tls

library

vulnerability

complete_io

fix

versions

0.0004 Low

EPSS

Percentile

15.1%

JSON

Rustls is a modern TLS library written in Rust. rustls::ConnectionCommon::complete_io could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a close_notify message immediately after client_hello, the server’s complete_io will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.

CPENameOperatorVersion
rustlseq/0.5.2
rustlseq/0.21.0
rustlseq/0.16.0
rustlseq/0.15.2
rustlseq/0.13.0
rustlseq/0.5.4
rustlseq/0.23.2
rustlseq/0.20.0-beta1
rustlseq/0.15.1
rustlseq/0.5.7

Name	Operator	Version
rustls	eq	/0.5.2
rustls	eq	/0.21.0
rustls	eq	/0.16.0
rustls	eq	/0.15.2
rustls	eq	/0.13.0
rustls	eq	/0.5.4
rustls	eq	/0.23.2
rustls	eq	/0.20.0-beta1
rustls	eq	/0.15.1
rustls	eq	/0.5.7