{"id":"GHSA-qg5g-gv98-5ffh","summary":"rustls network-reachable panic in `Acceptor::accept`","details":"A bug introduced in rustls 0.23.13 leads to a panic if the received TLS ClientHello is fragmented.  Only servers that use `rustls::server::Acceptor::accept()` are affected.\n\nServers that use `tokio-rustls`'s `LazyConfigAcceptor` API are affected.\n\nServers that use `tokio-rustls`'s `TlsAcceptor` API are not affected.\n\nServers that use `rustls-ffi`'s `rustls_acceptor_accept` API are affected.\n","aliases":["CVE-2024-11738","RUSTSEC-2024-0399"],"modified":"2026-09-10T03:50:21.002934679Z","published":"2024-11-25T16:57:34Z","database_specific":{"nvd_published_at":null,"cwe_ids":[],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2024-11-25T16:57:34Z"},"references":[{"type":"WEB","url":"https://github.com/rustls/rustls/issues/2227"},{"type":"PACKAGE","url":"https://github.com/rustls/rustls"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2024-0399.html"}],"affected":[{"package":{"name":"rustls","ecosystem":"crates.io","purl":"pkg:cargo/rustls"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.23.13"},{"fixed":"0.23.18"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-qg5g-gv98-5ffh/GHSA-qg5g-gv98-5ffh.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P"}]}