Infinite Loop Vulnerability in rustls
Summary
CVE-2024-32650: rustls::ConnectionCommon::complete_io could fall into an infinite loop based on network input. Affects rustls across 3 version ranges.
>= 0.0.0-0, < 0.21.11
>= 0.22.0, < 0.22.4
>= 0.23.0, < 0.23.5
Fixed in 0.21.11, 0.22.4 or 0.23.5, depending on the release line you run. How to fix ↓
Also tracked for
- rust-rustls · Debian:12
The same CVE-2024-32650 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rustls is a Rust implementation of the TLS protocol. It provides a secure communication channel over the network. The rustls::ConnectionCommon::complete_io function is responsible for handling I/O operations during the TLS handshake. However, a vulnerability has been discovered in this function that can lead to an infinite loop if a close_notify alert is received during the handshake.
Vulnerability Detail
When a close_notify alert is received during the TLS handshake, the complete_io function in rustls does not terminate properly. This can result in an infinite loop, causing denial-of-service (DoS) conditions. It is important to note that this vulnerability only affects callers that use the complete_io function. The rustls-tokio and rustls-ffi libraries are not affected as they do not call complete_io. However, the rustls::Stream and rustls::StreamOwned types, which utilize complete_io, are vulnerable.
How To Fix
Latest published version: 0.23.46 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.0.0-0, < 0.21.110.21.11 -
>= 0.22.0, < 0.22.40.22.4 -
>= 0.23.0, < 0.23.50.23.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, if updating the rustls package is not immediately feasible, developers can avoid using the rustls::Stream and rustls::StreamOwned types that utilize the complete_io function. Instead, they can use the rustls-tokio or rustls-ffi libraries, which are not affected by this vulnerability.
Conclusion
The infinite loop vulnerability in rustls can lead to denial-of-service conditions. It is crucial to update the rustls package to the recommended versions or utilize the rustls-tokio or rustls-ffi libraries as a workaround. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for rustls →
FAQ
rustls is a Rust implementation of the TLS protocol, providing secure communication over the network.
Versions prior to 0.21.11, 0.22.4, and 0.23.5 are affected by this vulnerability.
This vulnerability can lead to denial-of-service (DoS) conditions due to an infinite loop in the complete_io function.
No, rustls-tokio and rustls-ffi libraries are not affected as they do not use the vulnerable complete_io function.
Yes, the CVSS score for this vulnerability is 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
References
Related vulnerabilities
Recent vulnerabilities recorded for rustls.
