CVE-2024-32650 Rustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client input

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Identified in Rustls Network Protocol Two vulnerabilities have been reported in the Rustls network protocol affecting its functionality. CVE-2024-11738, published on December 6, 2024, involves a network-reachable panic in the acceptor function, while CVE-2024-32650, published on April 19, 2024, is related to an infinite loop in the connection handling process. Both vulnerabilities could impact systems using Rustls for secure communications. 2 sources 41