Question 1

Is there a bug in tokio-rustls 0.12.0?

Accepted Answer

Excessive memory usage in tokio-rustls tokio-rustls does not call process_new_packets immediately after read, so the expected termination condition wants_read always returns true. As long as new incoming data arrives faster than it is processed and the reader does not return pending, data will be buffered. This may cause DoS. Fixed in tokio-rustls 0.12.3.

Question 2

Is there a bug in tokio-rustls 0.13.0?

Accepted Answer

tokio-rustls reads may cause excessive memory usage `tokio-rustls` does not call `process_new_packets` immediately after `read`,
so the expected termination condition `wants_read` always returns true.
As long as new incoming data arrives faster than it is processed
and the reader does not return pending, data will be buffered.

This may cause DoS. Fixed in tokio-rustls 0.13.1.

Severity	Affected	Fixed in	Title	Status	Source
high	0.12.0	0.12.3	Excessive memory usage in tokio-rustls tokio-rustls does not call process_new_packets immediately after read, so the expected termination condition wants_read always returns true. As long as new incoming data arrives faster than it is processed and the reader does not return pending, data will be buffered. This may cause DoS.	fixed	osv:GHSA-2jfv-g3fh-xq3v
medium	0.13.0	0.13.1	tokio-rustls reads may cause excessive memory usage `tokio-rustls` does not call `process_new_packets` immediately after `read`, so the expected termination condition `wants_read` always returns true. As long as new incoming data arrives faster than it is processed and the reader does not return pending, data will be buffered. This may cause DoS.	fixed	osv:RUSTSEC-2020-0019

tokio-rustls known bugs