{"id":"CVE-2024-11738","aliases":["AZL-61546","EUVD-2024-34179","GHSA-qg5g-gv98-5ffh","RUSTSEC-2024-0399","SUSE-SU-2026:1361-1","UBUNTU-CVE-2024-11738","openSUSE-SU-2024:14539-1"],"status":"published","title":"Rustls: rustls network-reachable panic in `acceptor::accept`","description":"A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00731,"percentile":0.54747,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-248"],"published":"2024-11-22T12:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"crates.io","package":"rustls","fixed_in":["0.23.18","0.23.0"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"rust","fixed_in":["1.86.0-6"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"himmelblau","fixed_in":["0.7.7+git.0.b48d0bb-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"rustls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.23.13"},{"fixed":"0.23.18"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.85.0"},{"fixed":"1.86.0-6"}]}]},{"source":"osv","ecosystem":"crates.io","package":"rustls","ranges":[{"type":"SEMVER","events":[{"introduced":"0.23.13"},{"fixed":"0.23.18"}]}]},{"source":"osv","ecosystem":"crates.io","package":"rustls","ranges":[{"type":"SEMVER","events":[{"introduced":"0.23.0"},{"fixed":"0.23.0"},{"introduced":"0.23.13"},{"fixed":"0.23.18"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"himmelblau","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.9+git0.a9fd29b-150700.3.15.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-rustls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.21.6-3","0.21.7-1","0.21.9-1","0.21.10-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rust-rustls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.25+ds-1","0.23.26+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-rustls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.36+ds-1","0.23.41+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-rustls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.26+ds-1","0.23.33+ds-3build2","0.23.35+ds-1","0.23.35+ds-1build1","0.23.36+ds-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"himmelblau","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.7+git.0.b48d0bb-1.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat trusted artifact signer"},{"vendor":"rustls_project","product":"rustls"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2024-11738","tags":["vdb-entry","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2328732","tags":["issue-tracking","x_refsource_REDHAT","Vendor Advisory","report"]},{"url":"https://github.com/advisories/GHSA-qg5g-gv98-5ffh","tags":["Third Party Advisory","advisory"]},{"url":"https://github.com/rustls/rustls","tags":["Product","package"]},{"url":"https://github.com/rustls/rustls/issues/2227","tags":["Exploit","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2024-0399.html","tags":["Vendor Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11738","tags":["web","advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/11xxx/CVE-2024-11738.json","tags":["advisory"]},{"url":"https://crates.io/crates/rustls","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261361-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1233949","tags":["report"]},{"url":"https://bugzilla.suse.com/1245437","tags":["report"]},{"url":"https://bugzilla.suse.com/1247735","tags":["report"]},{"url":"https://bugzilla.suse.com/1249013","tags":["report"]},{"url":"https://bugzilla.suse.com/1257904","tags":["report"]},{"url":"https://bugzilla.suse.com/1258236","tags":["report"]},{"url":"https://bugzilla.suse.com/1259548","tags":["report"]},{"url":"https://bugzilla.suse.com/1261324","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34397","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-11738","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-11738","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-11738","title":"Rustls: rustls network-reachable panic in `acceptor::accept`","description":"A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.","status":"published","published":"2024-12-06T14:54:11.31Z","modified":"2025-11-20T18:22:11.892Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:34:19.965827Z"}],"euvd":[{"id":"EUVD-2024-34179","description":"A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.","status":"published","published":"2024-12-06T14:54:11Z","modified":"2025-11-20T18:22:11Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T19:49:14.564249Z"}],"ghsa":[{"id":"GHSA-qg5g-gv98-5ffh","title":"rustls network-reachable panic in `Acceptor::accept`","description":"A bug introduced in rustls 0.23.13 leads to a panic if the received TLS ClientHello is fragmented.  Only servers that use `rustls::server::Acceptor::accept()` are affected.\n\nServers that use `tokio-rustls`'s `LazyConfigAcceptor` API are affected.\n\nServers that use `tokio-rustls`'s `TlsAcceptor` API are not affected.\n\nServers that use `rustls-ffi`'s `rustls_acceptor_accept` API are affected.\n","status":"published","published":"2024-11-25T16:57:34Z","modified":"2024-11-25T16:57:36Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T14:38:23.575854Z"}],"nvd":[{"id":"CVE-2024-11738","description":"A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.","status":"published","published":"2024-12-06T15:15:07.723Z","modified":"2026-06-17T06:58:20.81Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:10:39.434419Z"}],"osv":[{"id":"AZL-61546","title":"CVE-2024-11738 affecting package rust for versions less than 1.86.0-6","description":"A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.","status":"published","published":"2024-12-06T15:15:07Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-05T16:41:21.344052Z"},{"id":"CVE-2024-11738","title":"Rustls: rustls network-reachable panic in `acceptor::accept`","description":"A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.","status":"published","published":"2024-12-06T14:54:11.31Z","modified":"2026-10-28T02:30:53.825021842Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"GHSA-qg5g-gv98-5ffh","title":"rustls network-reachable panic in `Acceptor::accept`","description":"A bug introduced in rustls 0.23.13 leads to a panic if the received TLS ClientHello is fragmented.  Only servers that use `rustls::server::Acceptor::accept()` are affected.\n\nServers that use `tokio-rustls`'s `LazyConfigAcceptor` API are affected.\n\nServers that use `tokio-rustls`'s `TlsAcceptor` API are not affected.\n\nServers that use `rustls-ffi`'s `rustls_acceptor_accept` API are affected.\n","status":"published","published":"2024-11-25T16:57:34Z","modified":"2026-09-10T03:50:21.002934679Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T15:46:54.40888Z"},{"id":"UBUNTU-CVE-2024-11738","description":"A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.","status":"published","published":"2024-12-06T15:15:00Z","modified":"2026-10-17T12:56:43.120314954Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:41.555387Z"},{"id":"openSUSE-SU-2024:14539-1","title":"himmelblau-0.7.7+git.0.b48d0bb-1.1 on GA media","description":"These are all security issues fixed in the himmelblau-0.7.7+git.0.b48d0bb-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-03T00:00:00Z","modified":"2026-02-04T04:33:29.341648Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"RUSTSEC-2024-0399","title":"rustls network-reachable panic in `Acceptor::accept`","description":"A bug introduced in rustls 0.23.13 leads to a panic if the received\nTLS ClientHello is fragmented.  Only servers that use\n`rustls::server::Acceptor::accept()` are affected.\n\nServers that use `tokio-rustls`'s `LazyConfigAcceptor` API are affected.\n\nServers that use `tokio-rustls`'s `TlsAcceptor` API are not affected.\n\nServers that use `rustls-ffi`'s `rustls_acceptor_accept` API are affected.","status":"published","published":"2024-11-22T12:00:00Z","modified":"2025-10-28T06:28:52.287248Z","updated_at":"2026-11-02T15:53:39.971022Z"},{"id":"SUSE-SU-2026:1361-1","title":"Security update for himmelblau","description":"This update for himmelblau fixes the following issues:\n\nUpdate to version 2.3.9+git0.a9fd29b; (jsc#PED-14511):\n\n- CVE-2026-34397: Fix LPE due to name collision during NSS fake-primary group lookup (bsc#1261324).\n- CVE-2026-31979: Fix race condition when accessiung /tmp/krb5cc_uid (bsc#1259548).\n- CVE-2026-25727: deps(rust): Bump the `all-cargo-updates` group with 8 updates (bsc#1257904).\n- CVE-2025-58160: deps(rust): Bump `tracing-subscriber` in the cargo group (bsc#1249013).\n- CVE-2025-54882: Fix Kerberos credential cache permissions (bsc#1247735).\n- CVE-2025-53013: Fix permitted authentication with invalid Hello PIN (bsc#1245437).\n- CVE-2024-11738: Fix `rustls` network-reachable panic in `Acceptor::accept` (bsc#1233949).\n\nOther bug fixes:\n\n- Fix SELinux module packaging to use standard policy macros (bsc#1258236).\n","status":"published","published":"2026-04-15T14:14:00Z","modified":"2026-04-16T08:30:39.316405Z","updated_at":"2026-11-02T15:54:01.262144Z"}]}}