CVE-2025-4432
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
A flaw in Rust's Ring package causes a panic when overflow checking is enabled. In the QUIC protocol, an attacker can trigger this panic by sending a specially crafted packet. The issue occurs approximately once every 2^32 packets.
Risk Assessment
The risk is a potential denial-of-service (DoS) attack via a malicious QUIC packet, which could crash applications using the vulnerable Ring library.
Recommendation
Update the Ring package to the latest patched version. If an update is not possible, consider temporarily disabling overflow checking or applying filtering rules for QUIC traffic.
Original NVD description (English source)
A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC protocol, this flaw allows an attacker to induce this panic by sending a specially crafted packet. It will likely occur unintentionally in 1 out of every 2**32 packets sent or received.