CVE catalog

CVE-2024-32650

rust-rustls: CVE-2024-32650

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Apr 19, 2024, 4:15:10 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.95% · Oct 25, 2026

Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	rust-rustls	sid	`0.23.45+ds-1`	fixed
Debian	rust-rustls	forky	`0.23.45+ds-1`	fixed
Debian	rust-rustls	trixie	`0.23.26+ds-1`	fixed
Debian	rust-rustls	bookworm	`0.20.8-4`	vulnerable
Opensuse	gitoxide	leap 16.0	`0.56.0-bp160.1.1`	fixed
Suse	rust-keylime	linux micro 6.0	`0.2.6+13-1.1`	fixed
Opensuse	sccache	tumbleweed	`0.8.0~3-1.1`	fixed
Opensuse	kubetui	tumbleweed	`1.5.1-1.1`	fixed
Suse	gstreamer-plugins-rs	linux enterprise module for desktop applications 15 sp6	`0.12.11-150600.3.3.1`	fixed
Suse	gstreamer-plugins-rs	linux enterprise module for desktop applications 15 sp7	`0.12.11-150600.3.3.1`	fixed
Opensuse	gstreamer-plugins-rs	leap 15.6	`0.12.11-150600.3.3.1`	fixed
Opensuse	gitoxide	tumbleweed	`0.38.0-1.1`	fixed
Opensuse	topgrade	tumbleweed	`14.0.1-2.1`	fixed
Opensuse	tlrc	tumbleweed	`1.9.2+0-1.1`	fixed
Suse	git-cliff	package hub 15 sp5	`2.2.2-bp155.2.3.1`	fixed
Opensuse	git-cliff	leap 15.5	`2.2.2-bp155.2.3.1`	fixed
Opensuse	shadowsocks-rust	tumbleweed	`1.18.3-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	rust-rustls	source	sid	`0.21.12-1`	not yet assigned	Not reported	[1069677]
Debian	rust-rustls	source	forky	`0.21.12-1`	not yet assigned	Not reported	[1069677]
Debian	rust-rustls	source	trixie	`0.21.12-1`	not yet assigned	Not reported	[1069677]
Debian	rust-rustls	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1069677]
Opensuse	gitoxide	rpm	leap 16.0	`0.56.0-bp160.1.1`	Not reported	OPENSUSE-SU-2026:21558-1	Not reported
Suse	rust-keylime	rpm	linux micro 6.0	`0.2.6+13-1.1`	Not reported	SUSE-SU-2025:20057-1	Not reported
Opensuse	sccache	rpm	tumbleweed	`0.8.0~3-1.1`	Not reported	OPENSUSE-SU-2024:13961-1	Not reported
Opensuse	kubetui	rpm	tumbleweed	`1.5.1-1.1`	Not reported	OPENSUSE-SU-2024:13912-1	Not reported
Suse	gstreamer-plugins-rs	rpm	linux enterprise module for desktop applications 15 sp6	`0.12.11-150600.3.3.1`	Not reported	SUSE-SU-2025:03629-1	Not reported
Suse	gstreamer-plugins-rs	rpm	linux enterprise module for desktop applications 15 sp7	`0.12.11-150600.3.3.1`	Not reported	SUSE-SU-2025:03629-1	Not reported
Opensuse	gstreamer-plugins-rs	rpm	leap 15.6	`0.12.11-150600.3.3.1`	Not reported	SUSE-SU-2025:03629-1	Not reported
Opensuse	gitoxide	rpm	tumbleweed	`0.38.0-1.1`	Not reported	OPENSUSE-SU-2024:14424-1	Not reported
Opensuse	topgrade	rpm	tumbleweed	`14.0.1-2.1`	Not reported	OPENSUSE-SU-2024:13904-1	Not reported
Opensuse	tlrc	rpm	tumbleweed	`1.9.2+0-1.1`	Not reported	OPENSUSE-SU-2024:13917-1	Not reported
Suse	git-cliff	rpm	package hub 15 sp5	`2.2.2-bp155.2.3.1`	Not reported	OPENSUSE-SU-2024:0130-1	Not reported
Opensuse	git-cliff	rpm	leap 15.5	`2.2.2-bp155.2.3.1`	Not reported	OPENSUSE-SU-2024:0130-1	Not reported
Opensuse	shadowsocks-rust	rpm	tumbleweed	`1.18.3-1.1`	Not reported	OPENSUSE-SU-2024:13893-1	Not reported

[Debian bug #1069677]

Notes

[bookworm] rust-rustls: Minor issue

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]