{"cve":"CVE-2024-32650","nvd":{"published":"2024-04-19T16:15:10.940","modified":"2026-06-17T07:30:09.197","status":"Deferred","description":"Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-835"],"references":["https://github.com/rustls/rustls/commit/2123576840aa31043a31b0770e6572136fbe0c2d","https://github.com/rustls/rustls/commit/6e938bcfe82a9da7a2e1cbf10b928c7eca26426e","https://github.com/rustls/rustls/commit/f45664fbded03d833dffd806503d3c8becd1b71e","https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj","https://github.com/rustls/rustls/commit/2123576840aa31043a31b0770e6572136fbe0c2d"],"products":[],"source":"nvd","synced_at":"2026-10-19T21:49:08.435428910+00:00"},"epss":{"cve":"CVE-2024-32650","score":0.00949,"percentile":0.61219,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-6g7w-8wpp-frhj","url":"https://osv.dev/vulnerability/GHSA-6g7w-8wpp-frhj","summary":"Denial of Service Vulnerability in Rustls Library","modified":"2026-09-10T03:50:12.362313607Z","packages":[{"ecosystem":"crates.io","name":"rustls","purl":"pkg:cargo/rustls","ranges":[">=0.23.0 <0.23.5"],"fixed":["0.23.5"]},{"ecosystem":"crates.io","name":"rustls","purl":"pkg:cargo/rustls","ranges":[">=0.22.0 <0.22.4"],"fixed":["0.22.4"]},{"ecosystem":"crates.io","name":"rustls","purl":"pkg:cargo/rustls","ranges":[">=0.21.0 <0.21.11"],"fixed":["0.21.11"]},{"ecosystem":"crates.io","name":"rustls","purl":"pkg:cargo/rustls","ranges":["0.20"],"fixed":[]}]},{"id":"RUSTSEC-2024-0336","url":"https://osv.dev/vulnerability/RUSTSEC-2024-0336","summary":"`rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input","modified":"2026-10-12T18:00:07.054681492Z","packages":[{"ecosystem":"crates.io","name":"rustls","purl":"pkg:cargo/rustls","ranges":[">=0.0.0-0 <0.21.11",">=0.22.0 <0.22.4",">=0.23.0 <0.23.5"],"fixed":["0.21.11","0.22.4","0.23.5"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}