{"id":"CVE-2023-43669","aliases":["GHSA-9mcr-873m-xcxp","RUSTSEC-2023-0065"],"url":"https://o3.security/vulnerability/CVE-2023-43669","summary":"Tungstenite allows remote attackers to cause a denial of service","details":"The Tungstenite crate before 0.20.1 for Rust allows remote attackers to cause a denial of service (minutes of CPU consumption) via an excessive length of an HTTP header in a client handshake. The length affects both how many times a parse is attempted (e.g., thousands of times) and the average amount of data for each parse attempt (e.g., millions of bytes).","published":"2023-09-21T00:00:00Z","modified":"2026-07-15T01:49:11.260666135Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"crates.io","name":"tungstenite","fixedVersion":"0.20.1"}],"fix":{"url":"https://github.com/github/advisory-database/pull/2752","label":"github/advisory-database#2752"},"references":[{"type":"WEB","url":"https://crates.io/crates/tungstenite/versions"},{"type":"WEB","url":"https://cwe.mitre.org/data/definitions/407.html"},{"type":"WEB","url":"https://security-tracker.debian.org/tracker/CVE-2023-43669"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43669.json"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9mcr-873m-xcxp"},{"type":"ADVISORY","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R77EUWPZVP5WSMNXUXUDNHR7G7OI5NGM/"},{"type":"ADVISORY","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/THK6G6CD4VW6RCROWUV2C4HSINKK3XAK/"},{"type":"ADVISORY","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TT7SF6CQ5VHAGFLWNXY64NFSW4WIWE7D/"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-43669"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2240110"},{"type":"REPORT","url":"https://bugzilla.suse.com/show_bug.cgi?id=1215563"},{"type":"REPORT","url":"https://github.com/snapview/tungstenite-rs/issues/376"},{"type":"FIX","url":"https://github.com/github/advisory-database/pull/2752"},{"type":"FIX","url":"https://github.com/snapview/tungstenite-rs/commit/8b3ecd3cc0008145ab4bc8d0657c39d09db8c7e2"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-15T01:49:11.260666135Z"}}