DEBIAN-CVE-2026-123610

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-123610
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-123610.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-123610
Upstream
Published
2026-11-08T02:16:56Z
Modified
2026-11-08T10:00:16Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
[none]
Details

rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a certificate with a five-byte Brotli header requesting up to 1 GiB before authentication, aborting Brotli-enabled clients or client-authenticating servers whose allocator cannot satisfy the request.

References

Affected packages

Debian:12 / rust-rustls

Package

Name
rust-rustls
Purl
pkg:deb/debian/rust-rustls?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.20.8-4
0.20.8-4.1
0.20.8-4.2
0.21.5-1
0.21.5-2
0.21.5-3
0.21.5-4
0.21.5-5
0.21.6-1
0.21.6-2
0.21.6-3
0.21.6-4
0.21.7-1
0.21.8-1
0.21.8-2
0.21.8-3
0.21.8-3.1
0.21.9-1
0.21.10-1
0.21.12-1
0.21.12-2
0.21.12-3
0.21.12-4
0.21.12-5
0.21.12-6
0.21.12-7
0.21.12-8
0.21.12-9
0.23.16-1
0.23.20+ds-1
0.23.20+ds-2
0.23.20+ds-3
0.23.20+ds-4
0.23.20+ds-5
0.23.20+ds-6
0.23.20+ds-7
0.23.20+ds-8
0.23.20+ds-9
0.23.20+ds-10
0.23.25+ds-1
0.23.26+ds-1
0.23.31+ds-1
0.23.31+ds-2
0.23.31+ds-3
0.23.31+ds-4
0.23.31+ds-5
0.23.31+ds-6
0.23.31+ds-7
0.23.32+ds-1
0.23.32+ds-2
0.23.33+ds-1
0.23.33+ds-2
0.23.33+ds-3
0.23.33+ds-4
0.23.35+ds-1
0.23.36+ds-1
0.23.37+ds-1
0.23.37+ds-2
0.23.37+ds-3
0.23.38+ds-1
0.23.40+ds-1
0.23.41+ds-1
0.23.43+ds-1
0.23.45+ds-1
0.23.46+ds-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-123610.json"

Debian:13 / rust-rustls

Package

Name
rust-rustls
Purl
pkg:deb/debian/rust-rustls?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.23.26+ds-1
0.23.31+ds-1
0.23.31+ds-2
0.23.31+ds-3
0.23.31+ds-4
0.23.31+ds-5
0.23.31+ds-6
0.23.31+ds-7
0.23.32+ds-1
0.23.32+ds-2
0.23.33+ds-1
0.23.33+ds-2
0.23.33+ds-3
0.23.33+ds-4
0.23.35+ds-1
0.23.36+ds-1
0.23.37+ds-1
0.23.37+ds-2
0.23.37+ds-3
0.23.38+ds-1
0.23.40+ds-1
0.23.41+ds-1
0.23.43+ds-1
0.23.45+ds-1
0.23.46+ds-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-123610.json"

Debian:14 / rust-rustls

Package

Name
rust-rustls
Purl
pkg:deb/debian/rust-rustls?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.23.26+ds-1
0.23.31+ds-1
0.23.31+ds-2
0.23.31+ds-3
0.23.31+ds-4
0.23.31+ds-5
0.23.31+ds-6
0.23.31+ds-7
0.23.32+ds-1
0.23.32+ds-2
0.23.33+ds-1
0.23.33+ds-2
0.23.33+ds-3
0.23.33+ds-4
0.23.35+ds-1
0.23.36+ds-1
0.23.37+ds-1
0.23.37+ds-2
0.23.37+ds-3
0.23.38+ds-1
0.23.40+ds-1
0.23.41+ds-1
0.23.43+ds-1
0.23.45+ds-1
0.23.46+ds-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-123610.json"