Log in Start free

Vulnerability · Published May 9, 2025 · Assigned by redhat

CVE-2025-4432Ring: some aes functions may panic when overflow checking is enabled in ring

Medium 5.3

In plain English

A medium-severity resource allocation without limits in ring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)1.0%top 36.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC protocol, this flaw allows an attacker to induce this panic by sending a specially crafted packet. It will likely occur unintentionally in 1 out of every 2**32 packets sent or received.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12rust-ringno fix listedDEBIAN-CVE-2025-4432
Debian:13rust-ring0.17.14-1DEBIAN-CVE-2025-4432
Debian:14rust-ring0.17.14-1DEBIAN-CVE-2025-4432
Gogithub.com/briansmith/ringno fix listedGO-2025-3678
Ubuntu:22.04:LTSrust-ringno fix listedUBUNTU-CVE-2025-4432
Ubuntu:24.04:LTSrust-ringno fix listedUBUNTU-CVE-2025-4432
Ubuntu:25.10rust-ringno fix listedUBUNTU-CVE-2025-4432
Ubuntu:26.04:LTSrust-ringno fix listedUBUNTU-CVE-2025-4432
Ubuntu:26.10rust-ringno fix listedUBUNTU-CVE-2025-4432

Affected products (as reported)

VendorProductVersions
ring 0 – before 0.17.12
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat Satellite 6 see references
Red Hat Red Hat Satellite 6 see references
Red Hat Red Hat Trusted Artifact Signer see references
Red Hat Red Hat Trusted Artifact Signer see references
Red Hat Red Hat Trusted Profile Analyzer see references

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References