GHSA-c86p-w88r-qvqr
First published: Fri May 09 2025(Updated: )
A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC protocol, this flaw allows an attacker to induce this panic by sending a specially crafted packet. It will likely occur unintentionally in 1 out of every 2**32 packets sent or received.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| rust/ring | <0.17.13 | 0.17.13 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2025-4432
- https://github.com/briansmith/ring/pull/2447
- https://github.com/briansmith/ring/commit/ec2d3cf1d91f148c84e4806b4f0b3c98f6df3b38
- https://access.redhat.com/security/cve/CVE-2025-4432
- https://bugzilla.redhat.com/show_bug.cgi?id=2350655
- https://github.com/briansmith/ring
- https://github.com/briansmith/ring/blob/main/RELEASES.md#version-01712-2025-03-05
- https://rustsec.org/advisories/RUSTSEC-2025-0009.html
- https://github.com/advisories/GHSA-c86p-w88r-qvqr (Advisory)
Frequently Asked Questions
What is the severity of GHSA-c86p-w88r-qvqr?
GHSA-c86p-w88r-qvqr has been classified as a moderate severity vulnerability due to the potential for unintentional panics in the QUIC protocol.
How do I fix GHSA-c86p-w88r-qvqr?
To fix GHSA-c86p-w88r-qvqr, update the Ring package to version 0.17.13 or later.
What systems are affected by GHSA-c86p-w88r-qvqr?
GHSA-c86p-w88r-qvqr affects applications using the Ring package in Rust that have overflow checking enabled.
What is the nature of the vulnerability in GHSA-c86p-w88r-qvqr?
The vulnerability in GHSA-c86p-w88r-qvqr allows an attacker to trigger a panic in the QUIC protocol with specially crafted packets.
How often does the panic occur with GHSA-c86p-w88r-qvqr?
The panic associated with GHSA-c86p-w88r-qvqr is likely to occur unintentionally in 1 out of every 2^32 packets sent or received.
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-c86p-w88r-qvqr
- alias/CVE-2025-4432
- agent/software-canonical-lookup
- agent/weakness
- agent/references
- agent/severity
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/type
- agent/description
- agent/first-publish-date
- agent/event
- package-manager/rust