Network-Reachable Panic in rustls: Fragmented TLS ClientHello Handling Issue
Summary
CVE-2024-11738: rustls network-reachable panic in Acceptor::accept. Affects rustls versions >= 0.23.13, < 0.23.18. Fixed in 0.23.18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rustls is a modern TLS library written in Rust, designed to provide secure communication over the internet. It is known for its performance, safety, and ease of use. The library is widely adopted in various applications that require secure connections. However, a recent vulnerability has been identified in version 0.23.13, which affects servers using specific APIs of rustls, leading to potential application crashes when handling fragmented TLS ClientHello messages.
Vulnerability Detail
A bug introduced in rustls version 0.23.13 causes a panic when the received TLS ClientHello message is fragmented. This issue primarily affects servers that utilize the rustls::server::Acceptor::accept() method. Notably, servers using the tokio-rustls's LazyConfigAcceptor API are also impacted, while those using the TlsAcceptor API remain unaffected. Additionally, servers employing rustls-ffi's rustls_acceptor_accept API are vulnerable. The panic can lead to service disruptions, making it critical for affected users to address this vulnerability promptly.
How To Fix
Latest published version: 0.23.46 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.23.18
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider switching to the tokio-rustls's TlsAcceptor API if feasible, as it is not affected by this vulnerability. This may involve refactoring your code to accommodate the different API usage.
Conclusion
The rustls vulnerability introduced in version 0.23.13 poses a significant risk to servers using specific APIs, leading to potential application crashes when handling fragmented TLS ClientHello messages. It is crucial for users to update to version 0.23.18 or implement workarounds to mitigate the risk. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for rustls →
FAQ
The vulnerability can cause a panic in the server, leading to application crashes and service disruptions when handling fragmented TLS ClientHello messages.
Versions of rustls from 0.23.13 to 0.23.17 are affected. The issue is resolved in version 0.23.18.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Simply upload your Cargo.lock file to the Vulert playground at Vulert Scanner to check for vulnerabilities without any signup.
If an immediate update is not possible, consider using the tokio-rustls's TlsAcceptor API as a workaround, as it is not affected by this issue.
While the vulnerability primarily leads to application crashes, it does not directly expose data. However, service disruptions could indirectly affect data integrity and availability.
References
Related vulnerabilities
Recent vulnerabilities recorded for rustls.
