GHSA-h2v8-394m-p7vv

Suggest an improvement
Source
https://github.com/advisories/GHSA-h2v8-394m-p7vv
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-h2v8-394m-p7vv/GHSA-h2v8-394m-p7vv.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-h2v8-394m-p7vv
Aliases
Downstream
CGA (74)
CLEANSTART (1)
MINI (2)
Published
2026-10-27T16:08:36Z
Modified
2026-11-08T10:55:59Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.
Details

Summary

The built-in (but disabled by default) Brotli certificate decoder bounds the output buffer but accepts an input-selected history window. A header of five bytes can specify a 1 GiB window allocation. A peer can abort a process whose allocator cannot satisfy that request. A client must enable Brotli and connect to the peer; a server must enable Brotli and request a client certificate. Neither direction requires a trusted attacker certificate.

Details

rustls calls BrotliDecompress which enables Brotli's large-window extension. rustls applies a limit to certificates, but this applies to the decompressed result, and not to any internal allocations the process requires.

Impact

Client applications that enable the brotli feature will be vulnerable to malicious servers. Server applications that enable the brotli feature and enable client authentication will be vulnerable to malicious clients.

Potential for denial of service due to memory exhaustion from peers sending malicious Brotli-encoded certificates, for applications that enable Brotli decompression.

Acknowledgement

Thanks to OpenAI OutboundDisclosures@openai.com for the disclosure.

Database specific 
{
    "cwe_ids": [
        "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-27T16:08:36Z",
    "nvd_published_at": null,
    "severity": "LOW"
}
References

Affected packages

crates.io / rustls

Package

Name
rustls
View open source insights on deps.dev
Purl
pkg:cargo/rustls

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.23.46

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-h2v8-394m-p7vv/GHSA-h2v8-394m-p7vv.json"

crates.io / rustls

Package

Name
rustls
View open source insights on deps.dev
Purl
pkg:cargo/rustls

Affected ranges

Type
SEMVER
Events
Introduced
0.24.0-dev.1
Fixed
0.24.0-dev.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-h2v8-394m-p7vv/GHSA-h2v8-394m-p7vv.json"