CVE-2023-43669
The Tungstenite crate before 0.20.1 for Rust allows remote attackers to cause a denial of service (minutes of CPU consumption) via an excessive length...
Original description
The description as published by the source.
The Tungstenite crate before 0.20.1 for Rust allows remote attackers to cause a denial of service (minutes of CPU consumption) via an excessive length of an HTTP header in a client handshake. The length affects both how many times a parse is attempted (e.g., thousands of times) and the average amount of data for each parse attempt (e.g., millions of bytes).
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2023-43669 rust-tungstenite Fixed in: 0.20.1-1
- Ubuntu UBUNTU-CVE-2023-43669 rust-tungstenite
References
- advisory github.com
- advisory github.com
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory nvd.nist.gov
- patch github.com
- patch github.com
- report bugzilla.redhat.com
- report bugzilla.suse.com
- report github.com
- web crates.io
- web cwe.mitre.org
- web security-tracker.debian.org