CVE-2024-11738
Rustls: rustls network-reachable panic in `acceptor::accept`
A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Rustls: rustls network-reachable panic in `acceptor::accept`
A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.
- Record
CVE-2024-11738- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-248
- Updated
- 2026-11-02
EUVDEUVD-2024-34179
A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.
- Record
EUVD-2024-34179- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qg5g-gv98-5ffh
rustls network-reachable panic in `Acceptor::accept`
A bug introduced in rustls 0.23.13 leads to a panic if the received TLS ClientHello is fragmented. Only servers that use rustls::server::Acceptor::accept() are affected.
Servers that use tokio-rustls's LazyConfigAcceptor API are affected.
Servers that use tokio-rustls's TlsAcceptor API are not affected.
Servers that use rustls-ffi's rustls_acceptor_accept API are affected.
- Record
GHSA-qg5g-gv98-5ffh- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P - Updated
- 2026-11-02
NVD
A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.
- Record
CVE-2024-11738- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-248
- Updated
- 2026-11-02
OSVAZL-61546
CVE-2024-11738 affecting package rust for versions less than 1.86.0-6
A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.
- Record
AZL-61546- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-05
OSV
Rustls: rustls network-reachable panic in `acceptor::accept`
A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.
- Record
CVE-2024-11738- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-248
- Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-qg5g-gv98-5ffh
rustls network-reachable panic in `Acceptor::accept`
A bug introduced in rustls 0.23.13 leads to a panic if the received TLS ClientHello is fragmented. Only servers that use rustls::server::Acceptor::accept() are affected.
Servers that use tokio-rustls's LazyConfigAcceptor API are affected.
Servers that use tokio-rustls's TlsAcceptor API are not affected.
Servers that use rustls-ffi's rustls_acceptor_accept API are affected.
- Record
GHSA-qg5g-gv98-5ffh- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-11738
A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.
- Record
UBUNTU-CVE-2024-11738- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14539-1 No score
himmelblau-0.7.7+git.0.b48d0bb-1.1 on GA media
These are all security issues fixed in the himmelblau-0.7.7+git.0.b48d0bb-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14539-1- Updated
- 2026-11-02
OSVRUSTSEC-2024-0399 No score
rustls network-reachable panic in `Acceptor::accept`
A bug introduced in rustls 0.23.13 leads to a panic if the received
TLS ClientHello is fragmented. Only servers that use
rustls::server::Acceptor::accept() are affected.
Servers that use tokio-rustls's LazyConfigAcceptor API are affected.
Servers that use tokio-rustls's TlsAcceptor API are not affected.
Servers that use rustls-ffi's rustls_acceptor_accept API are affected.
- Record
RUSTSEC-2024-0399- Updated
- 2026-11-02
OSVSUSE-SU-2026:1361-1 No score
Security update for himmelblau
This update for himmelblau fixes the following issues:
Update to version 2.3.9+git0.a9fd29b; (jsc#PED-14511):
- CVE-2026-34397: Fix LPE due to name collision during NSS fake-primary group lookup (bsc#1261324).
- CVE-2026-31979: Fix race condition when accessiung /tmp/krb5cc_uid (bsc#1259548).
- CVE-2026-25727: deps(rust): Bump the
all-cargo-updatesgroup with 8 updates (bsc#1257904). - CVE-2025-58160: deps(rust): Bump
tracing-subscriberin the cargo group (bsc#1249013). - CVE-2025-54882: Fix Kerberos credential cache permissions (bsc#1247735).
- CVE-2025-53013: Fix permitted authentication with invalid Hello PIN (bsc#1245437).
- CVE-2024-11738: Fix
rustlsnetwork-reachable panic inAcceptor::accept(bsc#1233949).
Other bug fixes:
- Fix SELinux module packaging to use standard policy macros (bsc#1258236).
- Record
SUSE-SU-2026:1361-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rustlscrates.io |
0.23.13 up to 0.23.18 | 0.23.18 |
rustAzure Linux:3 |
1.85.0 up to 1.86.0-6 | 1.86.0-6 |
rustlscrates.io |
0.23.0 up to 0.23.0, 0.23.13 up to 0.23.18 | 0.23.00.23.18 |
himmelblauSUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 7 CVEs |
before 2.3.9+git0.a9fd29b-150700.3.15.1 | 2.3.9+git0.a9fd29b-150700.3.15.1 |
rust-rustlsUbuntu:24.04:LTS |
All versions, plus listed versions 0.21.6-30.21.7-10.21.9-10.21.10-1 |
None known |
rust-rustlsUbuntu:25.10 |
All versions, plus listed versions 0.23.25+ds-10.23.26+ds-1 |
None known |
rust-rustlsUbuntu:26.10 |
All versions, plus listed versions 0.23.36+ds-10.23.41+ds-1 |
None known |
rust-rustlsUbuntu:26.04:LTS |
All versions, plus listed versions 0.23.26+ds-10.23.33+ds-3build20.23.35+ds-10.23.35+ds-1build10.23.36+ds-1 |
None known |
himmelblauopenSUSE:Tumbleweed |
before 0.7.7+git.0.b48d0bb-1.1 | 0.7.7+git.0.b48d0bb-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-11738 is a medium vulnerability (CVSS 5.3) in Rustls Project Rustls, published November 22, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.73%, the 54th percentile. Fixed in rustls 0.23.18.
References
access.redhat.com/security/cve/CVE-2024-11738
bugzilla.redhat.com/show_bug.cgi?id=2328732
github.com/advisories/GHSA-qg5g-gv98-5ffh
rustsec.org/advisories/RUSTSEC-2024-0399.html
Show 22 moreShow less
nvd.nist.gov/vuln/detail/CVE-2024-11738
crates.io/crates/rustls
suse.com/support/update/announcement/2026/suse-su-20261361-1
bugzilla.suse.com/1233949
ubuntu.com/security/CVE-2024-11738
cve.org/CVERecord?id=CVE-2024-11738