Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

GHSA-h2v8-394m-p7vv

RUSTSEC-2026-0348

osv · GHSA-h2v8-394m-p7vv

• https://github.com/rustls/rustls/security/advisories/GHSA-h2v8-394m-p7vv
• https://github.com/rustls/rustls/pull/3297
• https://github.com/rustls/rustls/pull/3354
• https://github.com/rustls/rustls/commit/1aa987af37d0d79b98781d345895ac0059ce345c
• https://github.com/rustls/rustls/commit/402b7b78b7ae87d59e19cf07ee07f3fc19e6537e
• https://github.com/rustls/rustls
• https://github.com/rustls/rustls/releases/tag/v/0.23.46
• https://rustsec.org/advisories/RUSTSEC-2026-0348.html

osv · RUSTSEC-2026-0348

• https://crates.io/crates/rustls
• https://rustsec.org/advisories/RUSTSEC-2026-0348.html
• https://github.com/rustls/rustls/pull/3297

No related operational record is retained in the current change model.