Vulnerability MediumRUSTSEC-2024-0399 · rustls
RUSTSEC-2024-0399: rustls network-reachable panic in `Acceptor::accept`
Short answerA security vulnerability in the rustls crate: rustls network-reachable panic in `Acceptor::accept`. GitHub rates it Medium. Fixed in 0.23.0, 0.23.18: update to a fixed version.
| Crate | rustls |
|---|---|
| Type | Vulnerability (denial-of-service) |
| Affected versions | From 0.23.0 before 0.23.0; from 0.23.13 before 0.23.18. |
| Fixed in | 0.23.0, 0.23.18 |
| Severity | Medium (GitHub rating) |
| Published | 2024-11-22 |
| Last changed | 2025-10-28 |
| Also known as | CVE-2024-11738, GHSA-qg5g-gv98-5ffh |
What to do
- See which version you have:
cargo tree -i rustls(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p rustls. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplerustls = "0.23.18") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
A bug introduced in rustls 0.23.13 leads to a panic if the received TLS ClientHello is fragmented. Only servers that use rustls::server::Acceptor::accept() are affected.
Servers that use tokio-rustls's LazyConfigAcceptor API are affected.
Servers that use tokio-rustls's TlsAcceptor API are not affected.
Servers that use rustls-ffi's rustls_acceptor_accept API are affected.
References
- Package: crates.io/crates/rustls
- Advisory: rustsec.org/advisories/RUSTSEC-2024-0399.html
- Report: github.com/rustls/rustls/issues/2227
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for rustls
- Vulnerability HighRUSTSEC-2024-0336 · 2024-04-19`rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input
- Vulnerability MediumRUSTSEC-2026-0285 · 2026-09-14TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries
- Vulnerability MediumRUSTSEC-2026-0346 · 2026-10-14`Debug` impls for client session values expose TLS secrets
- Vulnerability LowRUSTSEC-2026-0347 · 2026-10-14Buffered application data sent to outer server after ECH rejection
- Vulnerability LowRUSTSEC-2026-0348 · 2026-10-14Brotli certificate decompression can allocate up to 1 GiB before authentication
- Vulnerability LowRUSTSEC-2026-0349 · 2026-10-14Unauthenticated ServerHello can downgrade later connections to classical key exchange
Up next
Same craterustls: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?