{"id":"CVE-2023-6180","aliases":["GHSA-pjrj-h4fg-6gm4"],"title":"tokio-boring vulnerable to resource exhaustion via memory leak","summary":"tokio-boring vulnerable to resource exhaustion via memory leak","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","vendor":"tokio-boring","product":"tokio-boring","ecosystem":"rust","affected":["tokio-boring >= 4.0.0, < 4.1.0"],"patched":["tokio-boring 4.1.0"],"published":"2023-12-05","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-pjrj-h4fg-6gm4","references":[{"url":"https://github.com/cloudflare/boring/security/advisories/GHSA-pjrj-h4fg-6gm4"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6180"},{"url":"https://github.com/cloudflare/boring/commit/a32783374f2682e6949fdb713910b1b9f103d3ed"},{"url":"https://github.com/cloudflare/boring"}],"tags":["osv","rust"],"epss":0.00619,"epssPercentile":0.48285,"ingestedAt":"2026-07-09T18:56:37.319Z","slug":"CVE-2023-6180","body":"## Overview\n\n### Impact\nThe tokio-boring library in version 4.0.0 is affected by a memory leak issue that can lead to excessive resource consumption and potential DoS by resource exhaustion. The `set_ex_data` function used by the library did not deallocate memory used by pre-existing data in memory each time after completing a TLS connection causing the program to consume more resources with each new connection.\n\n### Patches\nThe issue is fixed in version 4.1.0 of tokio-boring.\n\n### References\n[CVE-2023-6180 at cve.org](https://www.cve.org/CVERecord?id=CVE-2023-6180)\n\n\n## Affected packages\n\n- `tokio-boring >= 4.0.0, < 4.1.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `tokio-boring 4.1.0`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}