CVE-2025-4432

Published: May 9, 2025Modified: Jun 30, 2026Deferred

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploitability: 3.9 / Impact: 1.4

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC protocol, this flaw allows an attacker to induce this panic by sending a specially crafted packet. It will likely occur unintentionally in 1 out of every 2**32 packets sent or received.

Related CWEs

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (8)

https://access.redhat.com/security/cve/CVE-2025-4432

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2350655

Source: secalert@redhat.com

https://github.com/advisories/GHSA-4p46-pwfr-66x6

Source: secalert@redhat.com

https://github.com/briansmith/ring

Source: secalert@redhat.com

https://github.com/briansmith/ring/blob/main/RELEASES.md#version-01712-2025-03-05

Source: secalert@redhat.com

https://github.com/briansmith/ring/commit/ec2d3cf1d91f148c84e4806b4f0b3c98f6df3b38

Source: secalert@redhat.com

https://github.com/briansmith/ring/pull/2447

Source: secalert@redhat.com

https://rustsec.org/advisories/RUSTSEC-2025-0009.html

Source: secalert@redhat.com

Timeline

No history available yet.