GHSA-2jfv-g3fh-xq3v
Excessive memory usage in tokio-rustls
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| crates.io | tokio-rustls | >= 0.12.0, < 0.12.3 | 0.12.3 |
| crates.io | tokio-rustls | >= 0.13.0, < 0.13.1 | 0.13.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
tokio-rustls does not call process_new_packets immediately after read, so the expected termination condition wants_read always returns true. As long as new incoming data arrives faster than it is processed and the reader does not return pending, data will be buffered. This may cause DoS.
References
External links from the advisory. They lead to third-party sites.