CVE-2025-53604: Rust Web Push is vulnerable to a DoS attack via a large integer in a Content-Length header

July 5, 2025 (updated July 7, 2025)

The web-push crate before 0.10.4 for Rust allows a denial of service (memory consumption) in the built-in clients via a large integer in a Content-Length header. The patch was initially made available in version 0.10.3, but version 0.10.3 has since been yanked.

References

crates.io/crates/web-push
github.com/advisories/GHSA-287x-9rff-qvcg
github.com/pimeys/rust-web-push
github.com/pimeys/rust-web-push/commit/8447ed86bf3f24629abd7022b94104bf3cd64453
github.com/pimeys/rust-web-push/pull/68
nvd.nist.gov/vuln/detail/CVE-2025-53604
rustsec.org/advisories/RUSTSEC-2025-0015.html

Code Behaviors & Features

Detect and mitigate CVE-2025-53604 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →