Advisory Database
  • Advisories
  • Dependency Scanning
  1. cargo
  2. ›
  3. tokio-boring
  4. ›
  5. CVE-2023-6180

CVE-2023-6180: tokio-boring vulnerable to resource exhaustion via memory leak

December 5, 2023

The tokio-boring library in version 4.0.0 is affected by a memory leak issue that can lead to excessive resource consumption and potential DoS by resource exhaustion. The set_ex_data function used by the library did not deallocate memory used by pre-existing data in memory each time after completing a TLS connection causing the program to consume more resources with each new connection.

References

  • github.com/advisories/GHSA-pjrj-h4fg-6gm4
  • github.com/cloudflare/boring
  • github.com/cloudflare/boring/commit/a32783374f2682e6949fdb713910b1b9f103d3ed
  • github.com/cloudflare/boring/security/advisories/GHSA-pjrj-h4fg-6gm4
  • nvd.nist.gov/vuln/detail/CVE-2023-6180

Code Behaviors & Features

Detect and mitigate CVE-2023-6180 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 4.0.0 before 4.1.0, version 4.0.0

Fixed versions

  • 4.1.0

Solution

Upgrade to version 4.1.0 or above.

Impact 5.3 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Learn more about CVSS

Weakness

  • CWE-400: Uncontrolled Resource Consumption
  • CWE-401: Missing Release of Memory after Effective Lifetime
  • CWE-404: Improper Resource Shutdown or Release

Source file

cargo/tokio-boring/CVE-2023-6180.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Tue, 13 May 2025 12:14:34 +0000.