Most recent entries from all

EUVD-2026-261516

fkie_cve-2024-11738

A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.

msrc_CVE-2024-11738 — Rustls: rustls network-reachable panic in `acceptor::accept`

msrc_CVE-2024-11738

RUSTSEC-2024-0399 — rustls network-reachable panic in `Acceptor::accept`

Affected: crates.io: rustls

A bug introduced in rustls 0.23.13 leads to a panic if the received TLS ClientHello is fragmented. Only servers that use `rustls::server::Acceptor::accept()` are affected.

Servers that use `tokio-rustls`'s `LazyConfigAcceptor` API are affected.

Servers that use `tokio-rustls`'s `TlsAcceptor` API are not affected.

Servers that use `rustls-ffi`'s `rustls_acceptor_accept` API are affected.

UBUNTU-CVE-2024-11738

Affected: Ubuntu:24.04:LTS: rust-rustls, Ubuntu:25.10: rust-rustls, Ubuntu:26.04:LTS: rust-rustls

A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.

WID-SEC-W-2025-0686 — IBM DataPower Gateway: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM DataPower Gateway ausnutzen, um einen Denial of Service Angriff durchzuführen, oder seine Privilegien zu erweitern.