VDB
RUSTSEC-2024-0336
RUSTSEC-2024-0336
PUBLISHED
CVSS 7.5 HIGH
If a `close_notify` alert is received during a handshake, `complete_io` does not terminate. Callers which do not call `complete_io` are not affected. `rustls-tokio` and `rustls-ffi` do not call `complete_io` and are not affected. `rustls::Stream` and `rustls::StreamOwned` types use `complete_io` and are affected.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| crates.io | rustls | 0.0.0-0, 0.22.0, 0.23.0 |
Timeline
- Apr 19, 2024 CVE Published
- Oct 12, 2026 CVE Updated