https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T23:53:47.290801+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-10564 bdu:2026-10564 2026-10-02T23:53:47.550763+00:00 bdu:2026-10564 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0627 certfr-2026-avi-0627 — De multiples vulnérabilités ont été découvertes dans les produits Splunk. Certaines d'entre elles permettent à un attaq… 2026-10-02T23:53:47.550807+00:00 certfr-2026-avi-0627 https://cve.radiocsirt.org/vuln/euvd-2026-5155 EUVD-2026-5155 2026-10-02T23:53:47.550836+00:00 EUVD-2026-5155 https://cve.radiocsirt.org/vuln/fkie_cve-2024-32650 fkie_cve-2024-32650 2026-10-02T23:53:47.550856+00:00

Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.

 https://cve.radiocsirt.org/vuln/ghsa-6g7w-8wpp-frhj GHSA-6g7w-8wpp-frhj — Denial of Service Vulnerability in Rustls Library 2026-10-02T23:53:47.550901+00:00

Affected: crates.io: rustls

### Summary `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input.

### Details

Verified at `0.22` and `0.23` `rustls`, but `0.21` and `0.20` release lines are also affected. `tokio-rustls` and `rustls-ffi` do not call `complete_io` and are not affected. `rustls::Stream` and `rustls::StreamOwned` types use `complete_io` and are affected.

When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop where:

- `eof`: false - `until_handshaked`: true - `self.is_handshaking()`: true - `self.wants_write()`: false - `self.wants_read()`: false

### PoC

1. Run simple server: `cargo run --bin simpleserver test-ca/rsa/end.fullchain test-ca/rsa/end.key` 2. Run following python script ```python3 #!/usr/bin/env python3 import socket sock = socket.socket() sock.connect(("localhost", 4443)) print("Sending client hello...") # Fake handshake data of a client hello message. fake_handshake = """ 1603 0100 c801 0000 c403 03ec 12dd 1764 a439 fd7e 8c85 46b8 4d1e a06e b3d7 a051 f03c b817 470d 4c54 c5df 7200 001c eaea c02b c02f c02c c030 cca9 cca8 c013 c014 009c 009d 002f 0035 000a 0100 007f dada 0000 ff01 0001 0000 0000 1600 1400 0011 7777 772e 7769 6b69 7065 6469 612e 6f72 6700 1700 0000 2300 0000 0d00 1400 1204 0308 0404 0105 0308 0505 0108 0606 0102 0100…

 https://cve.radiocsirt.org/vuln/gsd-2024-32650 gsd-2024-32650 2026-10-02T23:53:47.551014+00:00 gsd-2024-32650 https://cve.radiocsirt.org/vuln/msrc_cve-2024-32650 msrc_CVE-2024-32650 — Rustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client input 2026-10-02T23:53:47.551033+00:00 msrc_CVE-2024-32650 https://cve.radiocsirt.org/vuln/opensuse-su-2024:0130-1 openSUSE-SU-2024:0130-1 — Security update for git-cliff 2026-10-02T23:53:47.551060+00:00

Security update for git-cliff

 https://cve.radiocsirt.org/vuln/rustsec-2024-0336 RUSTSEC-2024-0336 — `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input 2026-10-02T23:53:47.551084+00:00

Affected: crates.io: rustls

If a `close_notify` alert is received during a handshake, `complete_io` does not terminate.

Callers which do not call `complete_io` are not affected.

`rustls-tokio` and `rustls-ffi` do not call `complete_io` and are not affected.

`rustls::Stream` and `rustls::StreamOwned` types use `complete_io` and are affected.

 https://cve.radiocsirt.org/vuln/suse-su-2025:02809-1 SUSE-SU-2025:02809-1 — Security update for rust-keylime 2026-10-02T23:53:47.551124+00:00

Security update for rust-keylime

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-32650 UBUNTU-CVE-2024-32650 2026-10-02T23:53:47.551152+00:00

Affected: Ubuntu:24.04:LTS: rust-rustls, Ubuntu:25.10: rust-rustls, Ubuntu:26.04:LTS: rust-rustls

Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.