{"id":"EUVD-2024-0790","revision":"2f9b76054e4144c28519fe27c9c13db8","records":[{"revision":"2f9b76054e4144c28519fe27c9c13db8","observedAt":"2026-11-09T00:06:55.434+00:00","statement":{"source":"euvd","id":"EUVD-2024-0790","aliases":["CVE-2024-28854","GHSA-2qph-qpvm-2qf7"],"title":"tls-listener is a rust lang wrapper around a connection listener to support TLS. With the default configuration of tls-listener, a malicious user can open 6.4 `TcpStream`s a second, sending 0 bytes, and can trigger a DoS. The default config…","description":"tls-listener is a rust lang wrapper around a connection listener to support TLS. With the default configuration of tls-listener, a malicious user can open 6.4 `TcpStream`s a second, sending 0 bytes, and can trigger a DoS. The default configuration options make any public service using `TlsListener::new()` vulnerable to a slow-loris DoS attack. This impacts any publicly accessible service using the default configuration of tls-listener in versions prior to 0.10.0. Users are advised to upgrade. Users unable to upgrade may mitigate this by passing a large value, such as `usize::MAX` as the parameter to `Builder::max_handshakes`.\n\n","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/tmccombs/tls-listener/security/advisories/GHSA-2qph-qpvm-2qf7","https://github.com/tmccombs/tls-listener/commit/d5a7655d6ea9e53ab57c3013092c5576da964bc4","https://en.wikipedia.org/wiki/Slowloris_(computer_security)"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-0790","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Mar 15, 2024, 6:54:58 PM","dateUpdated":"Aug 2, 2024, 12:56:58 AM"},"relatedAdvisories":[{"id":"openSUSE-SU-2024:14009-1","title":"cargo-audit-advisory-db-20240528-1.1 on GA media","vulnerabilityIds":["CVE-2024-28854","CVE-2024-34063"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2024-0790","identifiers":["EUVD-2024-0790","CVE-2024-28854","GHSA-2qph-qpvm-2qf7"]},"retained":false,"historicalAffected":[]}],"coverage":[]}