TI-2024-19056 Aliases CVE-2024-28854 GHSA-2qph-qpvm-2qf7

Slow loris vulnerability with default configuration in tls-listener

HIGH 72CWE-400Published 2024-03-15 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

tls-listener is a rust lang wrapper around a connection listener to support TLS. With the default configuration of tls-listener, a malicious user can open 6.4 `TcpStream`s a second, sending 0 bytes, and can trigger a DoS. The default configuration options make any public service using `TlsListener::new()` vulnerable to a slow-loris DoS attack. This impacts any publicly accessible service using the default configuration of tls-listener in versions prior to 0.10.0. Users are advised to upgrade. Users unable to upgrade may mitigate this by passing a large value, such as `usize::MAX` as the parameter to `Builder::max_handshakes`.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00973 62nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed tls-listener (tmccombs): 0.10.0tls-listener (crates.io): 0.10.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
tmccombs	tls-listener	before 0.10.0	0.10.0	Patch available	CNA
—	tls-listener (crates.io)	before 0.10.0	0.10.0	Patch available	GHSA-2qph-qpvm-2qf7

tls-listener Vendortmccombs Affected before 0.10.0 Fixed in 0.10.0 Patch available CNA
tls-listener (crates.io) Vendor— Affected before 0.10.0 Fixed in 0.10.0 Patch available GHSA-2qph-qpvm-2qf7

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:tmccombs:tls-listener::::::rust::*	before 0.10.0	Vulnerable	tmccombs

cpe:2.3:a:tmccombs:tls-listener:*:*:*:*:*:rust:*:* Versions before 0.10.0 Vulnerable ·tmccombs

Remediation

Fix · CNA tls-listener (tmccombs) Fixed in 0.10.0
Fix · GHSA-2qph-qpvm-2qf7 tls-listener (crates.io) Fixed in 0.10.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-28854
2026-10-03 Alias added: GHSA-2qph-qpvm-2qf7

References

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences