cve/2024/CVE-2024-32650.md

### [CVE-2024-32650](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-32650)
![](https://img.shields.io/static/v1?label=Product&message=rustls&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3E%3D%200.23.0%2C%20%3C%200.23.5%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-835%3A%20Loop%20with%20Unreachable%20Exit%20Condition%20('Infinite%20Loop')&color=brighgreen)

### Description

Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.

### POC

#### Reference
- https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj
- https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj

#### Github
No PoCs found on GitHub currently.