The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
LowVulnerability
GHSA-h2v8-394m-p7vv: Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.
- Identifier
- GHSA-h2v8-394m-p7vv
- Published
- Record updated
- Affected
- rustls >= 0.24.0-dev.1, < 0.24.0-dev.2, fixed in 0.24.0-dev.2
- rustls < 0.23.46, fixed in 0.23.46
Summary
The rustls Brotli certificate decoder accepts an input-selected history window, so a five-byte header can force a 1 GiB allocation before authentication. A peer can exhaust memory and abort a process whose allocator cannot satisfy the request, affecting clients with the brotli feature enabled against malicious servers and servers with brotli and client authentication enabled against malicious clients.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.