GHSA-h2v8-394m-p7vv: Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.
The built-in (but disabled by default) Brotli certificate decoder bounds the output buffer but accepts an input-selected history window. A header of five bytes can specify a 1 GiB window allocation. A peer can abort a process whose allocator cannot satisfy that request. A client must enable Brotli and connect to the peer; a server must enable Brotli and request a client certificate. Neither direction requires a trusted attacker certificate.
References
- github.com/advisories/GHSA-h2v8-394m-p7vv
- github.com/rustls/rustls/commit/1aa987af37d0d79b98781d345895ac0059ce345c
- github.com/rustls/rustls/commit/402b7b78b7ae87d59e19cf07ee07f3fc19e6537e
- github.com/rustls/rustls/pull/3297
- github.com/rustls/rustls/pull/3354
- github.com/rustls/rustls/releases/tag/v/0.23.46
- github.com/rustls/rustls/security/advisories/GHSA-h2v8-394m-p7vv
- rustsec.org/advisories/RUSTSEC-2026-0348.html
Code Behaviors & Features
Detect and mitigate GHSA-h2v8-394m-p7vv with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →