Threats tagged 'ghsa-gg47-62fq-vrhp'

A memory allocation flaw exists in rustls versions before 0.23.46 in the optional Brotli certificate decompression feature. The flaw allows a malicious peer to request a large memory allocation (up to 1 GiB) via a crafted five-byte Brotli header before authentication. This can cause clients or servers using Brotli-enabled rustls to abort if their allocator cannot fulfill the request.