Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

ring

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.6crates.ioPublished

    Some AES functions may panic when overflow checking is enabled in ring

    CVE-2025-4432 · GHSA-4p46-pwfr-66x6

    Affected
    • crates.io ring < 0.17.12
    Fixed in
    0.17.12· Vendor fix available
    Issue
    ring::aead::quic::HeaderProtectionKey::newmask() may panic when overflow checking is enabled. In the QUIC protocol, an attacker can induce this panic by sending a specially-crafted packet. Even unintentionally it is likely to occur in 1 out of every 232 packets sent and/or received. On 64-bit targets operations using ring::aead::{AES128GCM, AES256GCM} may panic when overflow checking is enabled, when encrypting/decrypting approximately 68,719,476,700 bytes (about 64 gigabytes) of data in a single chunk. Protocols like TLS and SSH are not affected by this because those protocols break large amounts of data into small chunks. Similarly, most applications will not attempt to encrypt/decrypt 64GB of data in one chunk. Overflow checking is not enabled in release mode by default, but RUSTFLAGS="-C overflow-checks" or overflow-checks = true in the Cargo.toml profile can override this. Overflow checking is usually enabled by default in debug mode.

    Recommended action: Upgrade to 0.17.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →