{"id":"EUVD-2024-1125","revision":"b23a5e47dec04e519892ffa2d919a879","records":[{"revision":"b23a5e47dec04e519892ffa2d919a879","observedAt":"2026-11-02T22:03:40.167+00:00","statement":{"source":"euvd","id":"EUVD-2024-1125","aliases":["CVE-2024-32650","GHSA-6g7w-8wpp-frhj"],"title":"Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately afte…","description":"Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj","https://github.com/rustls/rustls/commit/2123576840aa31043a31b0770e6572136fbe0c2d","https://github.com/rustls/rustls/commit/6e938bcfe82a9da7a2e1cbf10b928c7eca26426e","https://github.com/rustls/rustls/commit/f45664fbded03d833dffd806503d3c8becd1b71e"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-1125","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 19, 2024, 4:05:44 PM","dateUpdated":"Aug 2, 2024, 2:13:40 AM"},"relatedAdvisories":[{"id":"openSUSE-SU-2024:13912-1","title":"kubetui-1.5.1-1.1 on GA media","vulnerabilityIds":["CVE-2024-32650"]},{"id":"openSUSE-SU-2024:13893-1","title":"shadowsocks-rust-1.18.3-1.1 on GA media","vulnerabilityIds":["CVE-2024-32650"]},{"id":"SUSE-SU-2025:02809-1","title":"Security update for rust-keylime","vulnerabilityIds":["CVE-2023-26964","CVE-2024-12224","CVE-2024-32650","CVE-2024-43806","CVE-2025-3416","CVE-2025-58266"]},{"id":"openSUSE-SU-2024:13903-1","title":"teleport-15.2.4-1.1 on GA media","vulnerabilityIds":["CVE-2023-45288","CVE-2024-29902","CVE-2024-32650"]},{"id":"SUSE-SU-2025:02811-1","title":"Security update for rust-keylime","vulnerabilityIds":["CVE-2023-26964","CVE-2024-12224","CVE-2024-32650","CVE-2024-43806","CVE-2025-3416","CVE-2025-58266"]},{"id":"openSUSE-SU-2024:0130-1","title":"Security update for git-cliff","vulnerabilityIds":["CVE-2024-32650"]},{"id":"SUSE-SU-2025:20057-1","title":"Security update for rust-keylime","vulnerabilityIds":["CVE-2024-32650","CVE-2024-43806"]},{"id":"SUSE-SU-2025:02810-1","title":"Security update for rust-keylime","vulnerabilityIds":["CVE-2023-26964","CVE-2024-12224","CVE-2024-32650","CVE-2024-43806","CVE-2025-3416","CVE-2025-58266"]},{"id":"openSUSE-SU-2024:13904-1","title":"topgrade-14.0.1-2.1 on GA media","vulnerabilityIds":["CVE-2024-32650"]},{"id":"openSUSE-SU-2026:21558-1","title":"Security update for gitoxide","vulnerabilityIds":["CVE-2024-32650","CVE-2025-22620","CVE-2025-31130","CVE-2026-25541","CVE-2026-40034"]},{"id":"openSUSE-SU-2024:14424-1","title":"gitoxide-0.38.0-1.1 on GA media","vulnerabilityIds":["CVE-2024-32650"]},{"id":"openSUSE-SU-2024:13917-1","title":"tlrc-1.9.2+0-1.1 on GA media","vulnerabilityIds":["CVE-2024-32650"]},{"id":"openSUSE-SU-2024:13923-1","title":"keylime-ima-policy-0.2.5~0-1.1 on GA media","vulnerabilityIds":["CVE-2024-32650"]},{"id":"SUSE-SU-2025:03629-1","title":"Security update for gstreamer-plugins-rs","vulnerabilityIds":["CVE-2024-32650"]},{"id":"openSUSE-SU-2024:13961-1","title":"sccache-0.8.0~3-1.1 on GA media","vulnerabilityIds":["CVE-2024-32650"]},{"id":"openSUSE-SU-2024:13969-1","title":"git-cliff-2.2.2-1.1 on GA media","vulnerabilityIds":["CVE-2024-32650"]},{"id":"msrc_CVE-2024-32650","title":"Rustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client input","vulnerabilityIds":["CVE-2024-32650"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2024-1125","identifiers":["EUVD-2024-1125","CVE-2024-32650","GHSA-6g7w-8wpp-frhj"]},"retained":false,"historicalAffected":[]}],"coverage":[]}