VDB
Sign up
HIGH7.5

GHSA-2jfv-g3fh-xq3v

Excessive memory usage in tokio-rustls

Details

tokio-rustls does not call process_new_packets immediately after read, so the expected termination condition wants_read always returns true. As long as new incoming data arrives faster than it is processed and the reader does not return pending, data will be buffered. This may cause DoS.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/tokio-rustls
Introduced in: 0.12.0Fixed in: 0.12.3

Upgrade tokio-rustls to 0.12.3 or newer (ecosystem crates.io).

crates.io/tokio-rustls
Introduced in: 0.13.0Fixed in: 0.13.1

Upgrade tokio-rustls to 0.13.1 or newer (ecosystem crates.io).

References