CVE-2024-32650

What it actually does

The flaw allows a blocking rustls server to enter an infinite loop in ConnectionCommon::complete_io when a client sends a close_notify alert immediately after the ClientHello message.

Why it matters to the business

Servers built on affected rustls versions can be made unresponsive by a remote attacker, disrupting availability of TLS-protected services with minimal effort.

How an attack unfolds

An attacker opens a TCP connection to a blocking rustls-based server, transmits a standard TLS ClientHello, and immediately follows it with a close_notify alert; the server's complete_io routine never exits the loop, consuming the thread indefinitely.

How to fix it

Upgrade rustls to version 0.23.5, 0.22.4, or 0.21.11 (or later) and rebuild all dependent applications. For swift-nio consumers, update to the commit 695afc5205aaa49fca092b94b479ff71c43d9d3c or newer equivalent release.

How to confirm the fix worked

Confirm the deployed rustls crate version is at or above a fixed release, then test the server with a minimal client that sends ClientHello followed immediately by close_notify and verify the connection handler terminates cleanly.

Typical attack path

1. Establish TCP connection to target server
2. Send TLS ClientHello record
3. Immediately send TLS close_notify alert
4. Observe server thread enter infinite loop and stop processing further connections

How to detect it

Search server logs and process listings for repeated or stuck TLS handshake threads that show no progress after receiving a ClientHello; correlate with inbound connections that terminate abnormally after the first two TLS records.

What your security team should do

• Prioritize upgrade of rustls in all blocking server deployments within the next maintenance window
• Review application code for direct or transitive use of rustls::ConnectionCommon::complete_io in blocking contexts
• Add automated dependency scanning to catch future rustls updates
• Monitor EPSS and exploit maturity; current values remain low but re-evaluate after any public proof-of-concept