{"id":"CVE-2024-32650","aliases":["RUSTSEC-2024-0336","GHSA-6g7w-8wpp-frhj"],"title":"`rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input","summary":"`rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"rustls","product":"rustls","ecosystem":"rust","affected":["rustls >= 0.23.0, < 0.23.5"],"patched":["rustls 0.23.5"],"published":"2024-04-19","updated":"2026-10-12","sourceUpdated":"2026-10-12T18:00:07.054681492Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2024-0336","references":[{"url":"https://crates.io/crates/rustls"},{"url":"https://rustsec.org/advisories/RUSTSEC-2024-0336.html"},{"url":"https://github.com/rustls/rustls/commit/2123576840aa31043a31b0770e6572136fbe0c2d"}],"tags":["osv","rust"],"epss":0.00949,"epssPercentile":0.60139,"ingestedAt":"2026-10-13T11:45:30.167Z","slug":"CVE-2024-32650","body":"## Overview\n\nIf a `close_notify` alert is received during a handshake, `complete_io`\ndoes not terminate.\n\nCallers which do not call `complete_io` are not affected.\n\n`rustls-tokio` and `rustls-ffi` do not call `complete_io`\nand are not affected.\n\n`rustls::Stream` and `rustls::StreamOwned` types use\n`complete_io` and are affected.\n\n## Affected packages\n\n- `rustls >= 0.23.0, < 0.23.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `rustls 0.23.5`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}