Skip to content
OpenAdvisories
High · 7.5 CVE-2024-32650 EUVD-2024-1125GHSA-6g7w-8wpp-frhjRUSTSEC-2024-0336

Rustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client input

Published Apr 19, 2024 · Updated Aug 2, 2024 · Assigned by GitHub_M

Vendor: rustls Product: rustls Package: cargo-audit Package: kdash Package: pgcat Package: rust-rustls Package: rust-rustls Package: rustls Package: samply Package: wasmcloud Package: xh Ecosystem: crates.io Ecosystem: Debian Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.

Affected products

VendorProductAffectedFixed
rustls rustls >= 0.23.0, < 0.23.5, >= 0.22.0, < 0.22.4, >= 0.21.0, < 0.21.11, = 0.20.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 rust-rustls 0.21.12-1 —
Debian 13 rust-rustls 0.21.12-1 —
Debian 12 rust-rustls No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 rust-rustls No fix yet —
Ubuntu 26.04 LTS rust-rustls No fix yet —
Ubuntu 25.10 rust-rustls No fix yet —
Ubuntu 24.04 LTS rust-rustls No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 gstreamer-plugins-rs 0.12.11-150600.3.3.1 SUSE-SU-2025:03629-1
SLES 15 SP7 sccache 0.16.0~0-150600.10.11.1 SUSE-SU-2026:3022-1
SLES 15 SP6 gstreamer-plugins-rs 0.12.11-150600.3.3.1 SUSE-SU-2025:03629-1
SLES 15 SP6 sccache 0.16.0~0-150600.10.11.1 SUSE-SU-2026:3022-1
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP6 sccache 0.16.0~0-150600.10.11.1 SUSE-SU-2026:3022-1
SLE Micro 6.0 rust-keylime 0.2.6+13-1.1 SUSE-SU-2025:20057-1
SLE Micro 5.5 rust-keylime 0.2.7+141-150500.3.5.1 SUSE-SU-2025:02811-1
SLE Micro 5.4 rust-keylime 0.2.7+141-150400.3.5.1 SUSE-SU-2025:02810-1
SLE Micro 5.3 rust-keylime 0.2.7+141-150400.3.7.1 SUSE-SU-2025:02809-1
SUSE Package Hub 15 SP5 git-cliff 2.2.2-bp155.2.3.1 openSUSE-SU-2024:0130-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed gitoxide 0.38.0-1.1 openSUSE-SU-2024:14424-1
openSUSE Tumbleweed kubetui 1.5.1-1.1 openSUSE-SU-2024:13912-1
openSUSE Tumbleweed sccache 0.8.0~3-1.1 openSUSE-SU-2024:13961-1
openSUSE Tumbleweed shadowsocks-rust 1.18.3-1.1 openSUSE-SU-2024:13893-1
openSUSE Tumbleweed teleport 15.2.4-1.1 openSUSE-SU-2024:13903-1
openSUSE Tumbleweed tlrc 1.9.2+0-1.1 openSUSE-SU-2024:13917-1
openSUSE Tumbleweed topgrade 14.0.1-2.1 openSUSE-SU-2024:13904-1
openSUSE Leap 16.0 gitoxide 0.56.0-bp160.1.1 openSUSE-SU-2026:21558-1
openSUSE Leap 15.6 gstreamer-plugins-rs 0.12.11-150600.3.3.1 SUSE-SU-2025:03629-1
openSUSE Leap 15.5 git-cliff 2.2.2-bp155.2.3.1 openSUSE-SU-2024:0130-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling cargo-audit 0.21.2-r1 —
Wolfi rolling kdash 0.6.1-r0 —
Wolfi rolling pgcat 1.2.0-r1 —
Wolfi rolling samply 0.12.0-r2 —
Wolfi rolling wasmcloud 1.1.0-r0 —
Wolfi rolling xh 0.22.2-r3 —

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io rustls >= 0.23.0, < 0.23.5 0.23.5 GHSA-6g7w-8wpp-frhj
crates.io rustls >= 0.22.0, < 0.22.4 0.22.4 GHSA-6g7w-8wpp-frhj
crates.io rustls >= 0.21.0, < 0.21.11 0.21.11 GHSA-6g7w-8wpp-frhj
crates.io rustls 0.20 — GHSA-6g7w-8wpp-frhj
crates.io rustls >= 0.0.0-0, < 0.21.11 · >= 0.22.0, < 0.22.4 · >= 0.23.0, < 0.23.5 0.21.11, 0.22.4, 0.23.5 RUSTSEC-2024-0336

Advisories 15

References