{"id":"EUVD-2024-0790","enisaUuid":"b079b264-8375-35ae-a616-f4da64f6fe6e","description":"tls-listener is a rust lang wrapper around a connection listener to support TLS. With the default configuration of tls-listener, a malicious user can open 6.4 `TcpStream`s a second, sending 0 bytes, and can trigger a DoS. The default configuration options make any public service using `TlsListener::new()` vulnerable to a slow-loris DoS attack. This impacts any publicly accessible service using the default configuration of tls-listener in versions prior to 0.10.0. Users are advised to upgrade. Users unable to upgrade may mitigate this by passing a large value, such as `usize::MAX` as the parameter to `Builder::max_handshakes`.\n\n","datePublished":"Mar 15, 2024, 6:54:58 PM","dateUpdated":"Aug 2, 2024, 12:56:58 AM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/tmccombs/tls-listener/security/advisories/GHSA-2qph-qpvm-2qf7\nhttps://github.com/tmccombs/tls-listener/commit/d5a7655d6ea9e53ab57c3013092c5576da964bc4\nhttps://en.wikipedia.org/wiki/Slowloris_(computer_security)\n","aliases":"CVE-2024-28854\nGHSA-2qph-qpvm-2qf7\n","assigner":"GitHub_M","epss":0.97,"enisaIdProduct":[{"id":"45716d25-6e2d-3168-8d66-e5ce7a06dcab","product":{"name":"tls-listener","vendor":{"name":"tmccombs"}},"product_version":"\u003c 0.10.0"},{"id":"da67e208-9332-3d6a-9ed8-ea2b744ab97a","product":{"name":"tls-listener","vendor":{"name":"tmccombs"}}}],"enisaIdVendor":[{"id":"5fabf74e-2720-3c8e-ab68-0f7d03d59609","vendor":{"name":"tmccombs"}}],"enisaIdVulnerability":[{"id":"4cede384-aa77-301e-95c9-5c6d27ada683","vulnerability":{"id":"GHSA-2qph-qpvm-2qf7","description":"tls-listener affected by the slow loris vulnerability with default configuration","datePublished":"Mar 15, 2024, 7:57:22 PM","dateUpdated":"Apr 9, 2025, 7:58:53 PM","baseScore":0.0,"references":"https://github.com/tmccombs/tls-listener/security/advisories/GHSA-2qph-qpvm-2qf7\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-28854\nhttps://github.com/tmccombs/tls-listener/commit/d5a7655d6ea9e53ab57c3013092c5576da964bc4\nhttps://en.wikipedia.org/wiki/Slowloris_(computer_security)\nhttps://github.com/tmccombs/tls-listener\nhttps://github.com/tmccombs/tls-listener/releases/tag/v0.10.0\nhttps://rustsec.org/advisories/RUSTSEC-2024-0341.html\n","enisa_id":"EUVD-2024-0790\n","aliases":"CVE-2024-28854\nGHSA-2qph-qpvm-2qf7\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:08:32 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"9b346a2b-2fd8-35c9-af06-e0031876975f","vulnerability":{"id":"CVE-2024-28854","description":"tls-listener is a rust lang wrapper around a connection listener to support TLS. With the default configuration of tls-listener, a malicious user can open 6.4 `TcpStream`s a second, sending 0 bytes, and can trigger a DoS. The default configuration options make any public service using `TlsListener::new()` vulnerable to a slow-loris DoS attack. This impacts any publicly accessible service using the default configuration of tls-listener in versions prior to 0.10.0. Users are advised to upgrade. Users unable to upgrade may mitigate this by passing a large value, such as `usize::MAX` as the parameter to `Builder::max_handshakes`.\n\n","datePublished":"Mar 15, 2024, 6:54:58 PM","dateUpdated":"Aug 2, 2024, 12:56:58 AM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/tmccombs/tls-listener/security/advisories/GHSA-2qph-qpvm-2qf7\nhttps://github.com/tmccombs/tls-listener/commit/d5a7655d6ea9e53ab57c3013092c5576da964bc4\nhttps://en.wikipedia.org/wiki/Slowloris_(computer_security)\n","enisa_id":"EUVD-2024-0790\n","assigner":"GitHub_M","epss":0.97,"dataProcessed":"Nov 4, 2026, 7:13:32 AM","vulnerabilityProduct":[{"id":"55668222-2848-4832-b8ee-f33c3220a403","product":{"name":"tls-listener","vendor":{"name":"tmccombs"}},"product_version":"\u003c 0.10.0"},{"id":"558144b1-6234-398c-be90-eaa40901fc47","product":{"name":"tls-listener","vendor":{"name":"tmccombs"}},"product_version":"\u003c 0.10.0"}],"vulnerabilityVendor":[{"id":"39559f21-7f13-3a42-abcb-04c9efebbae8","vendor":{"name":"tmccombs"}}]}}],"enisaIdAdvisory":[{"id":"5f6eb004-ea96-338c-99fc-242ef7c210de","advisory":{"id":"openSUSE-SU-2024:14009-1","description":"cargo-audit-advisory-db-20240528-1.1 on GA media","summary":"cargo-audit-advisory-db-20240528-1.1 on GA media","datePublished":"Jun 15, 2024, 12:00:00 AM","dateUpdated":"Sep 20, 2026, 9:12:00 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_14009-1.json\nhttps://www.suse.com/security/cve/CVE-2024-28854/\nhttps://www.suse.com/security/cve/CVE-2024-34063/\n","aliases":"CVE-2024-28854\nCVE-2024-34063\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"09bc3b1c-3fb2-3f33-9e49-999a86f67418","product":{"name":"cargo-audit-advisory-db-0:20240528-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"1415b773-9f76-3e87-99d6-c512ae8a0028","product":{"name":"cargo-audit-advisory-db-0:20240528-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"217501f2-ac88-33dc-af8e-1d1f8e0e45bf","product":{"name":"cargo-audit-advisory-db-20240528-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"4c1fd3c9-44f9-3510-b2e0-6ebea35acee1","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"5005b1da-06e4-3e9b-a90f-fe28662f1a9d","product":{"name":"cargo-audit-advisory-db-20240528-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"6726f8d7-7d51-3c61-bdd0-289d60a4cf44","product":{"name":"cargo-audit-advisory-db-0:20240528-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"b6b11f46-017f-3608-8084-1b1117ab69d6","product":{"name":"cargo-audit-advisory-db-20240528-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"c1339c08-520c-35bd-9394-be0ceb5f61e9","product":{"name":"cargo-audit-advisory-db-20240528-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"da33f063-16e5-353c-a41a-d0497840047b","product":{"name":"cargo-audit-advisory-db-0:20240528-1.1.s390x","vendor":{"name":"SUSE"}}}]}}]}