CVE-2026-123610 rustls before 0.23.46 Denial of Service via Brotli Certificate Decompression

rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a certificate with a five-byte Brotli header requesting up to ...

CVE-2026-123610 rustls before 0.23.46 Denial of Service via Brotli Certificate Decompression

rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a certificate with a five-byte Brotli header requesting up to ...

CVE-2026-123610

The rustls library (versions before 0.23.46 ) is vulnerable to a Denial of Service (DoS) attack due to an uncontrolled memory allocation flaw in its optional Brotli certificate decompression . While the library limits the decompressed output size, it fails to adequately restrict the history windo...

EUVD-2026-119369

rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a certificate with a five-byte Brotli header requesting up to ...

CVE-2026-123610: rustls: rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression,…

rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a certificate with a five-byte Brotli header requesting up to ...

PT-2026-139891

rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a certificate with a five-byte Brotli header requesting up to ...

Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.

Summary The built-in but disabled by default Brotli certificate decoder bounds the output buffer but accepts an input-selected history window. A header of five bytes can specify a 1 GiB window allocation. A peer can abort a process whose allocator cannot satisfy that request. A client must enable...

RUSTSEC-2026-0348 Brotli certificate decompression can allocate up to 1 GiB before authentication

The built-in Brotli certificate decompressor enabled by the non-default brotli crate feature bounded the size of the decompressed output, but accepted a peer-selected history window. Brotli's large-window extension was enabled, so a five-byte header could cause an allocation of 1 GiB. A peer can...

Brotli certificate decompression can allocate up to 1 GiB before authentication

The built-in Brotli certificate decompressor enabled by the non-default brotli crate feature bounded the size of the decompressed output, but accepted a peer-selected history window. Brotli's large-window extension was enabled, so a five-byte header could cause an allocation of 1 GiB. A peer can...