CVE-2024-32650 Rustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client input
A remote attacker can cause a denial of service in Rustls servers by sending a specific sequence of TLS messages, triggering an infinite loop.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-32650?
CVE-2024-32650 is a high-severity denial of service vulnerability in rustls, published on 19 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.
Weakness: CWE-835
Which versions are affected by CVE-2024-32650?
9 open source packages ship an affected version, including rustls.
| Package | Affected | Fixed in |
|---|---|---|
rustls crates.io | All versions | None |
rustls crates.io | All versions | None |
rustls crates.io | From 0.0.0-0 | 0.21.11, 0.22.4, 0.23.5 |
rustls crates.io | From 0.21.0 | 0.21.11 |
rustls crates.io | From 0.21.0 | 0.21.11 |
rustls crates.io | From 0.22.0 | 0.22.4 |
3 more packages
rustls crates.io | From 0.22.0 | 0.22.4 |
rustls crates.io | From 0.23.0 | 0.23.5 |
rustls crates.io | From 0.23.0 | 0.23.5 |
Linux distribution packages (11)
gstreamer-plugins-rs SUSE:Linux Enterprise Module for Desktop Applications 15 SP6 | All versions | 0.12.11-150600.3.3.1 |
gstreamer-plugins-rs SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | All versions | 0.12.11-150600.3.3.1 |
git-cliff SUSE:Package Hub 15 SP5 | All versions | 2.2.2-bp155.2.3.1 |
git-cliff openSUSE:Leap 15.5 | All versions | 2.2.2-bp155.2.3.1 |
gstreamer-plugins-rs openSUSE:Leap 15.6 | All versions | 0.12.11-150600.3.3.1 |
gitoxide openSUSE:Tumbleweed | All versions | 0.38.0-1.1 |
kubetui openSUSE:Tumbleweed | All versions | 1.5.1-1.1 |
sccache openSUSE:Tumbleweed | All versions | 0.8.0~3-1.1 |
shadowsocks-rust openSUSE:Tumbleweed | All versions | 1.18.3-1.1 |
tlrc openSUSE:Tumbleweed | All versions | 1.9.2+0-1.1 |
topgrade openSUSE:Tumbleweed | All versions | 14.0.1-2.1 |
How do I fix CVE-2024-32650?
Upgrade rustls to a fixed version for your release line: 0.21.11, 0.22.4 or 0.23.5.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-32650 being exploited?
There is no known exploitation of CVE-2024-32650 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2024-32650, GHSA-6g7w-8wpp-frhj, RUSTSEC-2024-0336, SUSE-SU-2025:03629-1, UBUNTU-CVE-2024-32650, openSUSE-SU-2024:0130-1 and 8 more.