{"id":"RUSTSEC-2024-0336","revision":"77967e40c9a34d7896093ccbc7bf8b2c","records":[{"revision":"77967e40c9a34d7896093ccbc7bf8b2c","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2024-0336","aliases":["CVE-2024-32650","GHSA-6g7w-8wpp-frhj"],"title":"`rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input","description":"If a `close_notify` alert is received during a handshake, `complete_io`\ndoes not terminate.\n\nCallers which do not call `complete_io` are not affected.\n\n`rustls-tokio` and `rustls-ffi` do not call `complete_io`\nand are not affected.\n\n`rustls::Stream` and `rustls::StreamOwned` types use\n`complete_io` and are affected.","state":0,"publishedAt":"2024-04-19T12:00:00+00:00","modifiedAt":"2026-10-12T18:00:07.0546815+00:00","affected":[{"ecosystem":"crates.io","name":"rustls","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"0.21.11"},{"kind":"introduced","version":"0.22.0"},{"kind":"fixed","version":"0.22.4"},{"kind":"introduced","version":"0.23.0"},{"kind":"fixed","version":"0.23.5"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null}],"references":["https://crates.io/crates/rustls","https://rustsec.org/advisories/RUSTSEC-2024-0336.html","https://github.com/rustls/rustls/commit/2123576840aa31043a31b0770e6572136fbe0c2d"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2024-0336","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2024-0336","identifiers":["RUSTSEC-2024-0336","CVE-2024-32650","GHSA-6g7w-8wpp-frhj"]},"retained":false,"historicalAffected":[]}],"coverage":[]}