CVE-2020-35875 Excessive memory usage in tokio-rustls
Attackers can cause excessive memory usage and potential denial of service by sending data quickly to applications using the tokio-rustls crate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-35875?
CVE-2020-35875 is a high-severity denial of service vulnerability in n/a, published on 31 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the tokio-rustls crate before 0.13.1 for Rust. Excessive memory usage may occur when data arrives quickly.
Which versions are affected by CVE-2020-35875?
5 open source packages ship an affected version, including tokio-rustls. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tokio-rustls crates.io | From 0.12.0 | 0.12.3, 0.13.1 |
tokio-rustls crates.io | From 0.12.0 | 0.12.3 |
tokio-rustls crates.io | From 0.12.0 | 0.12.3 |
tokio-rustls crates.io | From 0.13.0 | 0.13.1 |
tokio-rustls crates.io | From 0.13.0 | 0.13.1 |
Products include Tokio Tokio-Rustls.
How do I fix CVE-2020-35875?
Upgrade tokio-rustls to a fixed version for your release line: 0.12.3 or 0.13.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-35875 being exploited?
There is no known exploitation of CVE-2020-35875 in the wild and no public exploit code.
Sources
Also known as GHSA-2jfv-g3fh-xq3v, RUSTSEC-2020-0019.