Vulnerability HighRUSTSEC-2024-0336 · rustls
RUSTSEC-2024-0336: `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input
Short answerA security vulnerability in the rustls crate: `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. High severity (CVSS 7.5). Fixed in 0.21.11, 0.22.4, 0.23.5: update to a fixed version.
| Crate | rustls |
|---|---|
| Type | Vulnerability (denial-of-service) |
| Affected versions | Before 0.21.11; from 0.22.0 before 0.22.4; from 0.23.0 before 0.23.5. |
| Fixed in | 0.21.11, 0.22.4, 0.23.5 |
| Severity | High, CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| Published | 2024-04-19 |
| Last changed | 2026-10-12 |
| Also known as | CVE-2024-32650, GHSA-6g7w-8wpp-frhj |
| Affected functions | rustls::ConnectionCommon::complete_io |
What to do
- See which version you have:
cargo tree -i rustls(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p rustls. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplerustls = "0.23.5") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
If a close_notify alert is received during a handshake, complete_io does not terminate.
Callers which do not call complete_io are not affected.
rustls-tokio and rustls-ffi do not call complete_io and are not affected.
rustls::Stream and rustls::StreamOwned types use complete_io and are affected.
References
- Package: crates.io/crates/rustls
- Advisory: rustsec.org/advisories/RUSTSEC-2024-0336.html
- Web: github.com/rustls/rustls/commit/2123576840aa31043a31b0770e6572136fbe0c2d
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for rustls
- VulnerabilityRUSTSEC-2024-0399 · 2024-11-22rustls network-reachable panic in `Acceptor::accept`
- Vulnerability MediumRUSTSEC-2026-0285 · 2026-09-14TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries
- Vulnerability MediumRUSTSEC-2026-0346 · 2026-10-14`Debug` impls for client session values expose TLS secrets
- Vulnerability LowRUSTSEC-2026-0347 · 2026-10-14Buffered application data sent to outer server after ECH rejection
- Vulnerability LowRUSTSEC-2026-0348 · 2026-10-14Brotli certificate decompression can allocate up to 1 GiB before authentication
- Vulnerability LowRUSTSEC-2026-0349 · 2026-10-14Unauthenticated ServerHello can downgrade later connections to classical key exchange
Up next
Same craterustls: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?