MEDIUM 6.3 NVD
CVE-2026-123610
rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size bu
rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a certificate with a five-byte Brotli header requesting up to 1 GiB before authentication, aborting Brotli-enabled clients or client-authenticating servers whose allocator cannot satisfy the request.
References
- https://github.com/rustls/rustls/security/advisories/GHSA-h2v8-394m-p7vv
- https://www.vulncheck.com/advisories/rustls-before-0.23.46-denial-of-service-via-brotli-ce
This medium severity vulnerability with a CVSS score of 6.3 was published on 2026-11-08 via NVD.
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.