CVE-2024-32650High· 7.5▾ Twilight`rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.9%
If a close_notify alert is received during a handshake, complete_io
does not terminate.
Callers which do not call complete_io are not affected.
rustls-tokio and rustls-ffi do not call complete_io
and are not affected.
rustls::Stream and rustls::StreamOwned types use
complete_io and are affected.
rustls >= 0.23.0, < 0.23.5Upgrade to a patched release:
rustls 0.23.5Connected by shared product, vendor, weakness, or advisory.
RUSTSEC-2026-0347Low· 2.3Buffered application data sent to outer server after ECH rejection
RUSTSEC-2026-0348Low· 3.7Brotli certificate decompression can allocate up to 1 GiB before authentication
RUSTSEC-2026-0349Low· 3.7Unauthenticated ServerHello can downgrade later connections to classical key exchange
RUSTSEC-2026-0346Medium· 4.0`Debug` impls for client session values expose TLS secrets
RUSTSEC-2026-0285Medium· 5.3TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries
GHSA-h2v8-394m-p7vvLow· 3.7Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.