CVE-2023-24898
published 2023-05-09CVE-2023-24898: Windows SMB Denial of Service Vulnerability Windows SMB Denial of Service Vulnerability
high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
2.10%
79.5th percentile
Windows SMB Denial of Service Vulnerability
Windows SMB Denial of Service Vulnerability
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_server_2022 | >= 10.0.20348.0 < 10.0.20348.1724 | 10.0.20348.1724 |
| msrc | windows_server_2022 | — | — |
| rust-openssl_project | rust-openssl | >= 0 < 0.10.23-1ubuntu0.1~esm1 | 0.10.23-1ubuntu0.1~esm1 |
| rust-openssl_project | rust-openssl | >= 0 < 0.10.36-1ubuntu0.1~esm1 | 0.10.36-1ubuntu0.1~esm1 |
| rust-openssl_project | rust-openssl | >= 0 < 0.10.57-1ubuntu0.1~esm1 | 0.10.57-1ubuntu0.1~esm1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cvelistv57.5HIGH
osv9.1CRITICAL
vendor_msrc7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Windows SMB Denial of Service Vulnerability
vendor_msrc·2023-05-09·CVSS 7.5
CVE-2023-24898 [HIGH] Windows SMB Denial of Service Vulnerability
Windows SMB Denial of Service Vulnerability
FAQ: What version of Windows Server 2022 is affected by this vulnerability?
This vulnerability only affects the hotpatch version of Windows Server 2022. If you are not running this version of the operating system, no action is required for this vulnerability.
FAQ: What is SMB over QUIC?
SMB over QUIC introduces an alternative to the TCP network transport, providing secure, reliable connectivity to edge file servers over untrusted networks like the Internet. QUIC is an IETF-standardized protocol with many benefits when compared to TCP. For more information, please visit: SMB over QUIC.
Windows SMB: Windows SMB
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Denial of Service
Exploit Status: Publicly Disclosed:No;Exploited:No;Late
OSV
rust-openssl vulnerabilities
osv·2025-11-26·CVSS 9.1
CVE-2025-24898 rust-openssl vulnerabilities
rust-openssl vulnerabilities
Matt Mastracci discovered that rust-openssl was incorrectly handling server
lifetimes in certain functions. An attacker could possibly use this issue
to cause a denial of service or run arbitrary memory content to the client.
(CVE-2025-24898)
It was discovered that rust-openssl was incorrectly handling empty strings
when setting the host in certain functions. An attacker could possibly use
this issue to cause a denial of service. This issue only affected
Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-53159)
It was discovered that rust-openssl was incorrectly handling property
arguments in certain functions. An attacker could possibly use this
issue to cause a denial of service. This issue only affected
Ubuntu 24.04 LTS. (CVE-2025-3416)
CVEList
Windows SMB Denial of Service Vulnerability
cvelistv5·2023-05-09·CVSS 7.5
CVE-2023-24898 [HIGH] Windows SMB Denial of Service Vulnerability
Windows SMB Denial of Service Vulnerability
Windows SMB Denial of Service Vulnerability
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-05-09
Published