Description
The tokio-boring library in version 4.0.0 is affected by a memory leak issue that can lead to excessive resource consumption and potential DoS by resource exhaustion. The set_ex_data function used by the library did not deallocate memory used by pre-existing data in memory each time after completing a TLS connection causing the program to consume more resources with each new connection.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Cloudflare | tokio-boring | 4.0.0 – ≤ 4.1.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | tokio-boring | >= 4.0.0, < 4.1.0 | 4.1.0 | GHSA-pjrj-h4fg-6gm4 |