cve.bz

CVE-2024-32650

7.5 highEPSS 0.9%

High (7.5). EPSS 0.9% chance of exploitation in the next 30 days. Fixed in rustls 0.21.11, 0.22.4, 0.23.5.

Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
0.9% chance of exploitation in the next 30 days; higher than 61% of CVEs (scores of 2026-10-31)
CWE
CWE-835
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-6g7w-8wpp-frhjcrates.iorustls>=0.23.0 <0.23.50.23.5
GHSA-6g7w-8wpp-frhjcrates.iorustls>=0.22.0 <0.22.40.22.4
GHSA-6g7w-8wpp-frhjcrates.iorustls>=0.21.0 <0.21.110.21.11
GHSA-6g7w-8wpp-frhjcrates.iorustls0.20no fix published
RUSTSEC-2024-0336crates.iorustls>=0.0.0-0 <0.21.11
>=0.22.0 <0.22.4
>=0.23.0 <0.23.5		0.21.11, 0.22.4, 0.23.5

References

Check your stackJSON