A bug introduced in rustls 0.23.13 leads to a panic if the received TLS ClientHello is fragmented. Only servers that use rustls::server::Acceptor::accept()
are affected.
Servers that use tokio-rustls
's LazyConfigAcceptor
API are affected.
Servers that use tokio-rustls
's TlsAcceptor
API are not affected.
Servers that use rustls-ffi
's rustls_acceptor_accept
API are affected.
{ "nvd_published_at": null, "cwe_ids": [], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-11-25T16:57:34Z" }