Threats tagged 'rustsec-2026-0348'

Rustls versions from 0.23.9 up to but not including 0.23.46 with the non-default 'brotli' feature enabled have a vulnerability in the Brotli certificate decompressor. This flaw allows a malicious peer to cause a large memory allocation of up to 1 GiB before authentication, potentially leading to a denial of service if the allocator cannot satisfy the request. The vulnerability affects clients connecting to malicious servers and servers requesting client certificates, both with the 'brotli' feature enabled. Applications without this feature are not affected. A fix is available in version 0.23.46.