Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade rust-rustls | May 15, 2025 | Apr 19, 2024 |
| Suse | — | Upgrade rust-keylimeUpgrade gstreamer-plugins-rsUpgrade keylime-ima-policyUpgrade git-cliffUpgrade sccacheUpgrade git-cliff-zsh-completionUpgrade git-cliff-fish-completionUpgrade git-cliff-bash-completionUpgrade gstreamer-plugins-rs-devel | May 20, 2024 | Apr 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub