EUVD-2026-119369Published
rustls before 0.23.46 Denial of Service via Brotli Certificate Decompression
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-123610 · CVE overview and exploitation status
cve-program · CVE-2026-123610
- https://github.com/rustls/rustls/security/advisories/GHSA-h2v8-394m-p7vv
- https://www.vulncheck.com/advisories/rustls-before-0.23.46-denial-of-service-via-brotli-certificate-decompression
euvd · EUVD-2026-119369
- https://github.com/rustls/rustls/security/advisories/GHSA-h2v8-394m-p7vv
- https://www.vulncheck.com/advisories/rustls-before-0.23.46-denial-of-service-via-brotli-certificate-decompression
nvd · CVE-2026-123610
- https://github.com/rustls/rustls/security/advisories/GHSA-h2v8-394m-p7vv
- https://www.vulncheck.com/advisories/rustls-before-0.23.46-denial-of-service-via-brotli-certificate-decompression
osv · GHSA-h2v8-394m-p7vv
- https://github.com/rustls/rustls/security/advisories/GHSA-h2v8-394m-p7vv
- https://github.com/rustls/rustls/pull/3297
- https://github.com/rustls/rustls/pull/3354
- https://github.com/rustls/rustls/commit/1aa987af37d0d79b98781d345895ac0059ce345c
- https://github.com/rustls/rustls/commit/402b7b78b7ae87d59e19cf07ee07f3fc19e6537e
- https://github.com/rustls/rustls
- https://github.com/rustls/rustls/releases/tag/v/0.23.46
- https://rustsec.org/advisories/RUSTSEC-2026-0348.html
osv · RUSTSEC-2026-0348
Related changes
Linked by CVE identifier- rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a cer… · Advisory content revised · 14 Nov 2026
- rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a cer… · Advisory content revised · 14 Nov 2026
- rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a cer… · Advisory content revised · 10 Nov 2026
- rustls before 0.23.46 Denial of Service via Brotli Certificate Decompression · Newly collected advisory · 8 Nov 2026
- Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication. · Advisory content revised · 8 Nov 2026
- Brotli certificate decompression can allocate up to 1 GiB before authentication · Advisory content revised · 8 Nov 2026