Description
A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC protocol, this flaw allows an attacker to induce this panic by sending a specially crafted packet. It will likely occur unintentionally in 1 out of every 2**32 packets sent or received.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | ring | < 0.17.12 | 0.17.12 |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat Satellite 6 | — | — |
| Red Hat | Red Hat Trusted Artifact Signer | — | — |
| Red Hat | Red Hat Trusted Profile Analyzer | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rust-ring | 0.17.14-1 | — |
| Debian 13 | rust-ring | 0.17.14-1 | — |
| Debian 12 | rust-ring | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | rust-ring | No fix yet | — |
| Ubuntu 26.04 LTS | rust-ring | No fix yet | — |
| Ubuntu 25.10 | rust-ring | No fix yet | — |
| Ubuntu 24.04 LTS | rust-ring | No fix yet | — |
| Ubuntu 22.04 LTS | rust-ring | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250515T200012-1.1 | openSUSE-SU-2025:15135-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | trident | 0.28.0-1 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | atuin | 18.4.0-r1 | — |
| Wolfi rolling | buck2 | 20251101-r0 | — |
| Wolfi rolling | cargo-audit | 0.21.2-r1 | — |
| Wolfi rolling | deno | 2.2.3-r1 | — |
| Wolfi rolling | kdash | 0.6.2-r1 | — |
| Wolfi rolling | linkerd-extension-init | 0.1.2-r31 | — |
| Wolfi rolling | linkerd2-proxy | 2.285.0-r1 | — |
| Wolfi rolling | lychee | 0.18.1-r1 | — |
| Wolfi rolling | ntpd-rs | 1.5.0-r1 | — |
| Wolfi rolling | nushell +1 | 0.102.0-r1 | — |
| Wolfi rolling | oranda | 0.6.5-r3 | — |
| Wolfi rolling | parseable | 1.7.3-r1 | — |
| Wolfi rolling | pgcat | No fix yet | — |
| Wolfi rolling | pixi +1 | 0.42.1-r1 | — |
| Wolfi rolling | qdrant +2 | 1.13.4-r1 | — |
| Wolfi rolling | rustls-ffi +1 | 0.14.1-r4 | — |
| Wolfi rolling | rustup | 1.28.1-r1 | — |
| Wolfi rolling | rye | 0.44.0-r1 | — |
| Wolfi rolling | samply | 0.13.1-r1 | — |
| Wolfi rolling | sccache | 0.10.0-r1 | — |
| Wolfi rolling | sdp-k8s-injector +1 | 1.4.0-r0 | — |
| Wolfi rolling | shadowsocks-rust +5 | 1.22.0-r2 | — |
| Wolfi rolling | sqlx | 0.8.5-r2 | — |
| Wolfi rolling | tealdeer | 1.7.1-r3 | — |
| Wolfi rolling | uv +9 | 0.6.6-r1 | — |
| Wolfi rolling | wadm | 0.21.0-r0 | — |
| Wolfi rolling | wash | 0.39.0-r1 | — |
| Wolfi rolling | wasm-pack | 0.13.1-r2 | — |
| Wolfi rolling | wasmcloud | 1.6.2-r1 | — |
| Wolfi rolling | wasmtime +2 | 30.0.2-r1 | — |
| Wolfi rolling | xh | 0.24.0-r1 | — |
| Wolfi rolling | zed | 0.178.5-r0 | — |
| Wolfi rolling | zizmor | 1.5.1-r0 | — |
| Wolfi rolling | zola | 0.20.0-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | ring | < 0.17.12 | 0.17.12 | GHSA-4p46-pwfr-66x6 |
| crates.io | ring | >= 0.0.0-0, < 0.17.12 | 0.17.12 | RUSTSEC-2025-0009 |
| Go | github.com/briansmith/ring | all versions | — | GO-2025-3678 |
Advisories 1
- openSUSE-SU-2025:15135-1 govulncheck-vulndb-0.0.20250515T200012-1.1 on GA media SUSE / openSUSE Security Updates · Feb 5, 2026
References
- https://access.redhat.com/security/cve/CVE-2025-4432 vdb-entry
- RHBZ#2350655 issue-tracking
- https://github.com/advisories/GHSA-4p46-pwfr-66x6
- https://github.com/briansmith/ring
- https://github.com/briansmith/ring/blob/main/RELEASES.md#version-01712-2025-03-05
- https://github.com/briansmith/ring/commit/ec2d3cf1d91f148c84e4806b4f0b3c98f6df3b38
- https://github.com/briansmith/ring/pull/2447
- https://rustsec.org/advisories/RUSTSEC-2025-0009.html