CVE-2024-11738: Rustls: rustls network-reachable panic in `acceptor::accept`
A bug introduced in rustls 0.23.13 leads to a panic if the received TLS ClientHello is fragmented. Only servers that use rustls::server::Acceptor::accept() are affected.
Servers that use tokio-rustls's LazyConfigAcceptor API are affected.
Servers that use tokio-rustls's TlsAcceptor API are not affected.
Servers that use rustls-ffi's rustlsacceptoraccept API are affected.
Other sources
A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.
— NVD
Rustls: rustls network-reachable panic in acceptor::accept
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11738?
CVE-2024-11738 has been rated as a moderate severity vulnerability due to its potential to cause a crash in affected servers.
How do I fix CVE-2024-11738?
To resolve CVE-2024-11738, upgrade your rustls and tokio-rustls libraries to the latest versions that contain the patch.
Which software is affected by CVE-2024-11738?
CVE-2024-11738 affects servers using rustls 0.23.13 and those employing tokio-rustls's LazyConfigAcceptor API.
What happens if my server is affected by CVE-2024-11738?
If your server is affected by CVE-2024-11738, it may experience a panic when processing fragmented TLS ClientHello messages.
Is CVE-2024-11738 exploitable remotely?
Yes, CVE-2024-11738 can potentially be exploited remotely as it affects the handling of incoming TLS connections.