Log in Start free

Vulnerability · Published Sep 21, 2023 · Assigned by mitre

CVE-2023-43669

High 7.5

In plain English

A high-severity security flaw in the rust-tungstenite package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 81% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High
Exploit odds (30 days)2.1%top 18.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

The Tungstenite crate before 0.20.1 for Rust allows remote attackers to cause a denial of service (minutes of CPU consumption) via an excessive length of an HTTP header in a client handshake. The length affects both how many times a parse is attempted (e.g., thousands of times) and the average amount of data for each parse attempt (e.g., millions of bytes).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13rust-tungstenite0.20.1-1DEBIAN-CVE-2023-43669
Debian:14rust-tungstenite0.20.1-1DEBIAN-CVE-2023-43669
Ubuntu:24.04:LTSrust-tungsteniteno fix listedUBUNTU-CVE-2023-43669
Ubuntu:25.10rust-tungsteniteno fix listedUBUNTU-CVE-2023-43669
Ubuntu:26.04:LTSrust-tungsteniteno fix listedUBUNTU-CVE-2023-43669
Ubuntu:26.10rust-tungsteniteno fix listedUBUNTU-CVE-2023-43669

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References