« Volver al listado

CVE-2024-32650

Estado: AplazadaAlta (7.5)—

Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Rustls — RustlsAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-32650",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-32650",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-04-22T15:34:25.994212Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "rustls",
          "product": "rustls",
          "versions": [
            {
              "status": "affected",
              "version": ">= 0.23.0, < 0.23.5"
            },
            {
              "status": "affected",
              "version": ">= 0.22.0, < 0.22.4"
            },
            {
              "status": "affected",
              "version": ">= 0.21.0, < 0.21.11"
            },
            {
              "status": "affected",
              "version": "= 0.20.0"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:rustls_project:rustls:*:*:*:*:*:*:*:*"
          ],
          "vendor": "rustls_project",
          "product": "rustls",
          "versions": [
            {
              "status": "unknown",
              "version": "0.21.11"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-04-19T16:15:10.940",
  "references": [
    {
      "url": "https://github.com/rustls/rustls/commit/2123576840aa31043a31b0770e6572136fbe0c2d",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/rustls/rustls/commit/6e938bcfe82a9da7a2e1cbf10b928c7eca26426e",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/rustls/rustls/commit/f45664fbded03d833dffd806503d3c8becd1b71e",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/rustls/rustls/commit/2123576840aa31043a31b0770e6572136fbe0c2d",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/rustls/rustls/commit/6e938bcfe82a9da7a2e1cbf10b928c7eca26426e",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/rustls/rustls/commit/f45664fbded03d833dffd806503d3c8becd1b71e",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-835"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11."
    },
    {
      "lang": "es",
      "value": "Rustls es una librería TLS moderna escrita en Rust. `rustls::ConnectionCommon::complete_io` podría caer en un bucle infinito basado en la entrada de la red. Cuando se utiliza un servidor Rustls de bloqueo, si un cliente envía un mensaje `close_notify` inmediatamente después de `client_hello`, el `complete_io` del servidor entrará en un bucle infinito. Esta vulnerabilidad se solucionó en 0.23.5, 0.22.4 y 0.21.11."
    }
  ],
  "lastModified": "2026-06-17T07:30:09.197",
  "sourceIdentifier": "security-advisories@github.com"
}