AIKIDO-2025-10070

TL;DR

Affected versions of this package are affected by a design flaw arising from invalid memory access of the server buffer. The ssl::select_next_proto function returns a slice referencing the server's buffer but with a lifetime tied to the client's buffer. If the server buffer is deallocated first, an attacker can exploit this use-after-free vulnerability to crash the server or leak arbitrary memory contents.