CVE-2026-123610 · Package
NO FIX YET · SEE WHAT TO DO
rustls before 0.23.46 accepts an oversized Brotli history window in optional certificate decompression. A malicious peer can send a tiny certificate header before authentication that requests up to 1 GiB and aborts the client or server process.
first public Oct 14, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Rust applications that use rustls with the optional Brotli certificate decompression enabled, on either the client side or as a server that requests client certificates. Applications that do not enable that feature, or that run only on allocators able to satisfy the request, are less exposed; the sources do not say more.
Not affected if brotli-feature-disabled, default-config
Who cares rust, rustls, self-hosted, tls
Cargo.lock for rustls below 0.23.46.rustls moves to 0.23.46 or later.rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a certificate with a five-byte Brotli header requesting up to 1 GiB before authentication, aborting Brotli-enabled clients or client-authenticating servers whose allocator cannot satisfy the request.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.