Reported

October 14, 2026

Issued

October 14, 2026

Package

rustls (crates.io)

Type

Vulnerability

Categories

• denial-of-service

Aliases

• GHSA-h2v8-394m-p7vv

References

• https://github.com/rustls/rustls/pull/3297

CVSS Score

3.7 LOW

CVSS Details

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality Impact

None

Integrity Impact

None

Availability Impact

Low

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Patched

• >=0.23.46

Unaffected

• <0.23.9

Description

The built-in Brotli certificate decompressor (enabled by the non-default brotli crate feature) bounded the size of the decompressed output, but accepted a peer-selected history window. Brotli's large-window extension was enabled, so a five-byte header could cause an allocation of 1 GiB. A peer can abort a process whose allocator cannot satisfy that request.

No trusted certificate is required by the attacker. Affected configurations are:

• clients that enable the brotli feature and connect to a malicious server, and
• servers that enable the brotli feature and request client certificates.

Applications that do not enable the brotli feature are not affected.

Advisory available under CC0-1.0 license.