CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2024-11738
High (7.5) in rustls project rustls. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in rustls 0.23.0, 0.23.18.
A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
- CWE
- CWE-248
- Published
- Modified
- Record from
- the NVD, synced
Affected
- rustls_project:rustls
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-qg5g-gv98-5ffh | crates.io | rustls | >=0.23.13 <0.23.18 | 0.23.18 |
| RUSTSEC-2024-0399 | crates.io | rustls | >=0.23.0 <0.23.0 >=0.23.13 <0.23.18 | 0.23.0, 0.23.18 |