CVE-2020-35896: 
Rust vulnerability analysis and mitigation

A vulnerability was discovered in the ws crate through 2020-09-25 for Rust, identified as CVE-2020-35896. The issue relates to improper limitation of the outgoing buffer, which could lead to remote memory-consumption attacks (NVD, RustSec).

The vulnerability stems from insufficient size checks in the outgoing buffer of the ws crate. The affected versions did not properly check and cap the growth of the outgoing buffer, allowing it to grow unconstrained. The vulnerability has been assigned a CVSS score of 7.5 (HIGH), with attack vector being Network, attack complexity Low, requiring no privileges or user interaction (RustSec).

This vulnerability enables a remote attacker to cause denial of service by growing the buffer of their single connection until the process exhausts available memory and is terminated. The impact is primarily on availability, with no direct effect on confidentiality or integrity (RustSec).

The vulnerability is easily exploitable remotely with low complexity and requires no special privileges or user interaction. An attacker can trigger the vulnerability through a network connection to the affected service (RustSec).

The flaw was corrected in the parity-ws fork (>=0.10.0) by implementing a mechanism to disconnect clients when their buffer becomes full. For the original ws crate, no official patch was released (RustSec).