CVE Feed

    Dashboard / CVE / CVE-2024-11738

    CVE-2024-11738

    A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.

    Published:Nov 25, 2024
    Last Modified:Nov 20, 2025
    EPS:Dec 6, 2024
    EPSS Score:0.011
    CVSS Score:5.3

    Affected Products

    Vendor
    Redhat
    Product
    Trusted Artifact Signer
    Vendor
    Rustls Project
    Product
    Rustls

    Exploits

    https://github.com/rustls/rustls/issues/2227

    Common Weakness Enumeration

    CWE-248 Uncaught Exception

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-4427 (CVSS 7.5) — Duplicate of CVE-2026-32286…
    CVE-2025-11065 (CVSS 5.3) — A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.…
    CVE-2025-8556 (CVSS 3.7) — A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker …
    CVE-2025-4574 (CVSS 6.5) — In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could,…
    CVE-2025-3416 (CVSS 3.7) — A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can…
    CVE-2025-30204 (CVSS 7.5) — golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 an…
    CVE-2025-4432 (CVSS 5.3) — A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QU…
    CVE-2025-22868 (CVSS 7.5) — An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.…
    CVE-2025-22869 (CVSS 7.5) — SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients …
    CVE-2025-27144 (CVSS 6.6) — Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, inc…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High