RUSTSEC-2026-0348Low· 3.7▾ SunlitBrotli certificate decompression can allocate up to 1 GiB before authentication
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The built-in Brotli certificate decompressor (enabled by the non-default
brotli crate feature) bounded the size of the decompressed output, but
accepted a peer-selected history window. Brotli's large-window extension was
enabled, so a five-byte header could cause an allocation of 1 GiB. A peer can
abort a process whose allocator cannot satisfy that request.
No trusted certificate is required by the attacker. Affected configurations are:
brotli feature and connect to a malicious server, andbrotli feature and request client certificates.Applications that do not enable the brotli feature are not affected.
rustls >= 0.23.9, < 0.23.46Upgrade to a patched release:
rustls 0.23.46Connected by shared product, vendor, weakness, or advisory.
RUSTSEC-2026-0347Low· 2.3Buffered application data sent to outer server after ECH rejection
RUSTSEC-2026-0349Low· 3.7Unauthenticated ServerHello can downgrade later connections to classical key exchange
RUSTSEC-2026-0346Medium· 4.0`Debug` impls for client session values expose TLS secrets
RUSTSEC-2026-0285Medium· 5.3TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries
CVE-2024-32650High· 7.5`rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input
GHSA-2mjx-qc3c-rqvcMedium· 5.3Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries