CVE-2023-6180
The tokio-boring library in version 4.0.0 is affected by a memory leak issue that can lead to excessive resource consumption and potential DoS by resource exhaustion. The set_ex_data function used by the library did not deallocate memory used by pre-existing data in memory each time after completing a TLS connection causing the program to consume more resources with each new connection.
- Score
- CVSS 3.1 5.3 Medium
- Status
- Modified - cna@cloudflare.com
- Published
- 2023-12-05
- Last modified
- 2024-08-02
- Weaknesses
- CWE-400, CWE-401, CWE-404
Affected products
References
- https://github.com/cloudflare/boring/security/advisories/GHSA-pjrj-h4fg-6gm4