CVE-2020-35875

CVE-2020-35875 affects the Rust crate tokio-rustls (before 0.13.1). The root cause is that tokio-rustls does not call process_new_packets immediately after read, causing wants_read to always return true and allowing data to accumulate in memory when data arrives faster than it is processed. This ...

CVE-2020-35875

An issue was discovered in the tokio-rustls crate before 0.13.1 for Rust. Excessive memory usage may occur when data arrives quickly...

Rust Security Vulnerabilities

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in Rust tokio-rustls crate before 0.13.1, which stems from the possibility of excessive memory usage when data arrives quickly...

CVE-2020-35875: Undefined Security Weakness

An issue was discovered in the tokio-rustls crate before 0.13.1 for Rust. Excessive memory usage may occur when data arrives quickly...

RUSTSEC-2020-0019 tokio-rustls reads may cause excessive memory usage

tokio-rustls does not call processnewpackets immediately after read, so the expected termination condition wantsread always returns true. As long as new incoming data arrives faster than it is processed and the reader does not return pending, data will be buffered. This may cause DoS...

a2 (>=0.5.0-alpha.6, <=0.5.0-alpha.7), azure_sdk_auth_aad (>=0.30.0, <=0.35.0) +19 more potentially affected by CVE-2020-35875 via tokio-rustls (>=0.12.0-alpha.1, <=0.12.0-alpha.8)

tokio-rustls CARGO version =0.12.0-alpha.1, =0.5.0-alpha.6, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =0.1.0-alpha.1, =0.1.0, =0.30.0, =3.2.2, =3.4.2 and more Source cves: CVE-2020-35875 Source advisory: OSV:RUSTSEC-2020-0019...

tokio-rustls reads may cause excessive memory usage

tokio-rustls does not call processnewpackets immediately after read, so the expected termination condition wantsread always returns true. As long as new incoming data arrives faster than it is processed and the reader does not return pending, data will be buffered. This may cause DoS...

PT-2020-17507

Name of the Vulnerable Software and Affected Versions tokio-rustls versions prior to 0.13.1 Description The issue is related to excessive memory usage that may occur when data arrives quickly. This happens because tokio-rustls does not call process new packets immediately after read, causing the...

CVE-2019-15541

rustls-mio/examples/tlsserver.rs in the rustls crate before 0.16.0 for Rust allows attackers to cause a denial of service loop of connevent and ready by arranging for a client to never be writable...

CVE-2019-15541

rustls-mio/examples/tlsserver.rs in the rustls crate before 0.16.0 for Rust allows attackers to cause a denial of service loop of connevent and ready by arranging for a client to never be writable...

Design/Logic Flaw

rustls-mio/examples/tlsserver.rs in the rustls crate before 0.16.0 for Rust allows attackers to cause a denial of service loop of connevent and ready by arranging for a client to never be writable...

CVE-2019-15541

rustls-mio/examples/tlsserver.rs in the rustls crate before 0.16.0 for Rust allows attackers to cause a denial of service loop of connevent and ready by arranging for a client to never be writable...

CVE-2019-15541

rustls-mio/examples/tlsserver.rs in the rustls crate before 0.16.0 for Rust allows attackers to cause a denial of service loop of connevent and ready by arranging for a client to never be writable...

CVE-2019-15541

CVE-2019-15541 concerns rustls-mio/tlsserver.rs in the rustls crate prior to 0.16.0. The root cause is a denial-of-service condition caused by a loop between conn_event and ready when a client is never writable, enabling an attacker to stall connections. Affected component: rustls-mio (Rust). Imp...

PT-2019-14257

Name of the Vulnerable Software and Affected Versions rustls crate versions prior to 0.16.0 Description The issue allows attackers to cause a denial of service by arranging for a client to never be writable, resulting in a loop of conn event and ready. Recommendations For versions prior to 0.16.0...

CVE-2019-15541: Improper Neutralization of Argument Delimiters in a Command

rustls-mio/examples/tlsserver.rs in the rustls crate before 0.16.0 for Rust allows attackers to cause a denial of service loop of connevent and ready by arranging for a client to never be writable...