CVE-2024-11738mediumCWE-248

CVE-2024-11738: medium-severity vulnerability in rustls

Rustls: rustls network-reachable panic in `acceptor::accept`

Published · Updated

Follow this CVE+ Monitor Red Hat Trusted Artifact Signer+ Monitor rustls

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.7%
A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
rustlsRed Hat · Red Hat Trusted Artifact Signer
Related CVEs — rustls

In the same product, most dangerous first.

CVE-2025-4432MEDIUMRing: some aes functions may panic when overflow checking is enabled in ringEPSS 1.0%CVE-2025-4574MEDIUMCrossbeam-channel: crossbeam-channel vulnerable to double free on dropEPSS 0.6%CVE-2025-8556LOWGithub.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect resultsEPSS 0.5%CVE-2025-3416LOWRust-openssl: rust-openssl use-after-free in `md::fetch` and `cipher::fetch`EPSS 0.5%CVE-2025-11065MEDIUMGithub.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructureEPSS 0.5%