CVE-2025-4432

Description

A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC protocol, this flaw allows an attacker to induce this panic by sending a specially crafted packet. It will likely occur unintentionally in 1 out of every 2**32 packets sent or received.

Reserved 2025-05-08 | Published 2025-05-09 | Updated 2025-05-09 | Assigner redhat

Problem types

Allocation of Resources Without Limits or Throttling

Product status

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Timeline

2025-03-07:	Reported to Red Hat.
2025-03-07:	Made public.

References

access.redhat.com/security/cve/CVE-2025-4432 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2350655 (RHBZ#2350655) issue-tracking

github.com/briansmith/ring

github.com/briansmith/ring/blob/main/RELEASES.md

github.com/...ommit/ec2d3cf1d91f148c84e4806b4f0b3c98f6df3b38

github.com/briansmith/ring/pull/2447

rustsec.org/advisories/RUSTSEC-2025-0009.html

cve.org (CVE-2025-4432)

nvd.nist.gov (CVE-2025-4432)

Download JSON