{"id":"ghsa-ghsa-h2v8-394m-p7vv","seq":1708777,"kind":"advisory","title":"Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.","url":"https://github.com/advisories/GHSA-h2v8-394m-p7vv","permalink":"https://vulnpulse.app/items/ghsa-ghsa-h2v8-394m-p7vv","summary":"影響: rust:rustls < 0.23.46 → 0.23.46, rust:rustls >= 0.24.0-dev.1, < 0.24.0-dev.2 → 0.24.0-dev.2\nThe built-in (but disabled by default) Brotli certificate decoder bounds the output buffer but accepts an input-selected history window. A header of five bytes can specify a 1 GiB window allocation. A peer can abort a process whose allocator cannot satisfy that request. A client must enable Brotli and connect to the peer; a server must enable Brotli and request a client certificate. Neither direction requires a trusted attacker certificate. Details rustls calls BrotliDecompress which enables Br…","severity":"low","techs":["rust"],"cves":[],"tags":["GHSA-h2v8-394m-p7vv","rustls","rustls"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T16:08:36.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}