CVE Vulnerabilities

CVE-2024-32650

Loop with Unreachable Exit Condition ('Infinite Loop')

Published: Apr 19, 2024 | Modified: Apr 19, 2024
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

Rustls is a modern TLS library written in Rust. rustls::ConnectionCommon::complete_io could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a close_notify message immediately after client_hello, the servers complete_io will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.

Weakness

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

References