rustsec-2026-0348

{
  "aliases": [
    "GHSA-h2v8-394m-p7vv"
  ],
  "categories": [
    "denial-of-service"
  ],
  "crate": "rustls",
  "cves": [],
  "cvss": 0.0,
  "database_specific": {
    "severity": "low"
  },
  "date": "2026-10-14",
  "deb_packages": [
    {
      "crate_name": "acme-redirect",
      "deb_name": "acme-redirect",
      "version": "0.8.1+ds-1"
    },
    {
      "crate_name": "apt-swarm",
      "deb_name": "apt-swarm",
      "version": "0.6.0-3"
    },
    {
      "crate_name": "apt-transport-blob",
      "deb_name": "apt-transport-blob",
      "version": "1.2.2-1+b2"
    },
    {
      "crate_name": "bmap-rs",
      "deb_name": "bmap-rs",
      "version": "0.2.3-1"
    },
    {
      "crate_name": "cargo-audit",
      "deb_name": "cargo-audit",
      "version": "0.22.2-1+b3"
    },
    {
      "crate_name": "css-inline",
      "deb_name": "css-inline",
      "version": "0.22.0-1"
    },
    {
      "crate_name": "debian-lsp",
      "deb_name": "debian-lsp",
      "version": "0.1.8-5+b2"
    },
    {
      "crate_name": "debian-repro-status",
      "deb_name": "debian-repro-status",
      "version": "0.4.0-3"
    },
    {
      "crate_name": "sequoia-chameleon-gnupg",
      "deb_name": "gpg-sq",
      "version": "0.13.1-15"
    },
    {
      "crate_name": "sequoia-chameleon-gnupg",
      "deb_name": "gpgv-sq",
      "version": "0.13.1-15"
    },
    {
      "crate_name": "hickory-dns",
      "deb_name": "hickory-dns",
      "version": "0.26.3-1+b2"
    },
    {
      "crate_name": "hussh",
      "deb_name": "hussh",
      "version": "0.2.3-1"
    },
    {
      "crate_name": "hypothesis",
      "deb_name": "hypothesis-client",
      "version": "0.12.0-4+b3"
    },
    {
      "crate_name": "icu4x-datagen",
      "deb_name": "icu4x-datagen",
      "version": "2.2.0-1+b2"
    },
    {
      "crate_name": "miniserve",
      "deb_name": "miniserve",
      "version": "0.35.0-6"
    },
    {
      "crate_name": null,
      "deb_name": "nethsm-pkcs11",
      "version": "2.0.0-3+b2"
    },
    {
      "crate_name": "ntpd",
      "deb_name": "ntpd-rs",
      "version": "1.9.0-1+b2"
    },
    {
      "crate_name": "ntpd",
      "deb_name": "ntpd-rs-metrics",
      "version": "1.9.0-1+b2"
    },
    {
      "crate_name": "numbat-cli",
      "deb_name": "numbat",
      "version": "1.24.0-1"
    },
    {
      "crate_name": "ognibuild",
      "deb_name": "ognibuild",
      "version": "0.2.21-1"
    },
    {
      "crate_name": null,
      "deb_name": "patch-hub",
      "version": "0.1.7-3+b2"
    },
    {
      "crate_name": "protonup-rs",
      "deb_name": "protonup-rs",
      "version": "0.15.0-1+b2"
    },
    {
      "crate_name": "prr",
      "deb_name": "prr",
      "version": "0.21.0-2+b2"
    },
    {
      "crate_name": "rbw",
      "deb_name": "rbw",
      "version": "1.15.0-2+b2"
    },
    {
      "crate_name": "rebuildctl",
      "deb_name": "rebuildctl",
      "version": "0.28.0-2"
    },
    {
      "crate_name": "rebuilderd",
      "deb_name": "rebuilderd",
      "version": "0.28.0+ds-2+b2"
    },
    {
      "crate_name": "rebuilderd-worker",
      "deb_name": "rebuilderd-worker",
      "version": "0.28.0-1+b2"
    },
    {
      "crate_name": "repro-env",
      "deb_name": "repro-env",
      "version": "0.4.4+ds-1"
    },
    {
      "crate_name": "repro-threshold",
      "deb_name": "repro-threshold",
      "version": "0.1.2-1+b2"
    },
    {
      "crate_name": "ripasso-cursive",
      "deb_name": "ripasso-cursive",
      "version": "0.8.0-1+b7"
    },
    {
      "crate_name": null,
      "deb_name": "safe-vdash",
      "version": "0.20.0-6+b2"
    },
    {
      "crate_name": "samply",
      "deb_name": "samply",
      "version": "0.13.1-1+b2"
    },
    {
      "crate_name": "sequoia-git",
      "deb_name": "sequoia-git",
      "version": "0.6.0-2+b2"
    },
    {
      "crate_name": "signal-tlsd",
      "deb_name": "signal-tlsd",
      "version": "0.1.4-1+b2"
    },
    {
      "crate_name": "silver-platter",
      "deb_name": "silver-platter",
      "version": "0.8.4-2+b3"
    },
    {
      "crate_name": "spytrap-adb",
      "deb_name": "spytrap-adb",
      "version": "0.3.5-6"
    },
    {
      "crate_name": "sequoia-sq",
      "deb_name": "sq",
      "version": "1.4.1-2"
    },
    {
      "crate_name": null,
      "deb_name": "taskwarrior",
      "version": "3.5.0+dfsg-3+b2"
    },
    {
      "crate_name": "tealdeer",
      "deb_name": "tealdeer",
      "version": "1.9.0-2"
    },
    {
      "crate_name": "xh",
      "deb_name": "xh",
      "version": "0.26.3-1"
    }
  ],
  "description": "The built-in Brotli certificate decompressor (enabled by the non-default\n`brotli` crate feature) bounded the size of the decompressed output, but\naccepted a peer-selected history window. Brotli's large-window extension was\nenabled, so a five-byte header could cause an allocation of 1 GiB. A peer can\nabort a process whose allocator cannot satisfy that request.\n\nNo trusted certificate is required by the attacker. Affected configurations are:\n\n- clients that enable the `brotli` feature and connect to a malicious server, and\n- servers that enable the `brotli` feature and request client certificates.\n\nApplications that do not enable the `brotli` feature are not affected.",
  "id": "RUSTSEC-2026-0348",
  "keywords": [],
  "patched_versions": [
    ">=0.23.46"
  ],
  "source": "debian_rustsec",
  "title": "Brotli certificate decompression can allocate up to 1 GiB before authentication",
  "url": "https://github.com/rustls/rustls/pull/3297"
}