« Volver al listado

CVE-2023-6180

Estado: ModificadaMedia (5.3)—

The tokio-boring library in version 4.0.0 is affected by a memory leak issue that can lead to excessive resource consumption and potential DoS by resource exhaustion. The set_ex_data function used by the library did not deallocate memory used by pre-existing data in memory each time after completing a TLS connection causing the program to consume more resources with each new connection.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cloudflare — Boring

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-6180",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@cloudflare.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cna@cloudflare.com",
      "affectedData": [
        {
          "vendor": "Cloudflare",
          "modules": [
            "toki-boring"
          ],
          "product": "tokio-boring",
          "versions": [
            {
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "4.1.0"
            }
          ],
          "packageName": "boring",
          "collectionURL": "https://github.com/cloudflare/boring/tree/master/tokio-boring",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-12-05T15:15:08.703",
  "references": [
    {
      "url": "https://github.com/cloudflare/boring/security/advisories/GHSA-pjrj-h4fg-6gm4",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@cloudflare.com"
    },
    {
      "url": "https://github.com/cloudflare/boring/security/advisories/GHSA-pjrj-h4fg-6gm4",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@cloudflare.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        },
        {
          "lang": "en",
          "value": "CWE-404"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-401"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The tokio-boring library in version 4.0.0 is affected by a memory leak issue that can lead to excessive resource consumption and potential DoS by resource exhaustion. The set_ex_data function used by the library did not deallocate memory used by pre-existing data in memory each time after completing a TLS connection causing the program to consume more resources with each new connection.\n"
    },
    {
      "lang": "es",
      "value": "La librería tokio-boring en la versión 4.0.0 se ve afectada por un problema de pérdida de memoria que puede provocar un consumo excesivo de recursos y una posible DoS por agotamiento de los recursos. La función set_ex_data utilizada por la librería no desasignó la memoria utilizada por los datos preexistentes en la memoria cada vez que se completó una conexión TLS, lo que provocó que el programa consumiera más recursos con cada nueva conexión."
    }
  ],
  "lastModified": "2026-06-17T06:50:15.297",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cloudflare:boring:4.0.0:*:*:*:*:rust:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FE7E647F-7BD0-4C49-BF61-E39D8B8B318D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@cloudflare.com"
}