Read the docs
TI-2026-86752 Aliases CVE-2026-123610GHSA-gg47-62fq-vrhp

Uncontrolled memory allocation in rustls Brotli certificate decompression

Priority MEDIUM 43CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

rustls before 0.23.46 contains an uncontrolled memory allocation flaw (CWE-770) in its optional Brotli certificate decompression. The decompressor accepts an input-selected large history window, so a certificate with a five-byte Brotli header can request up to 1 GiB of memory. A remote peer can send such a certificate before authentication, aborting Brotli-enabled clients or client-authenticating servers whose allocator cannot satisfy the request.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

Description from the CNA

rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a certificate with a five-byte Brotli header requesting up to 1 GiB before authentication, aborting Brotli-enabled clients or client-authenticating servers whose allocator cannot satisfy the request.

Why it matters now

Fix Fixed rustls (rustls): 0.23.46

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
rustlsrustlsbefore 0.23.460.23.46Patch availableCNA
  • rustls Vendorrustls Affected before 0.23.46 Fixed in 0.23.46 Patch available CNA

Remediation

Upgrade rustls to version 0.23.46 or later, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

  • Fix · CNA rustls (rustls) Fixed in 0.23.46

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    rustls 0.23.46

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-86753 Key exchange downgrade in rustls via unauthenticated ServerHelloPriority MEDIUM 43
    • TI-2026-86754 Application data sent to public_name server when rustls rejects ECHPriority LOW 36
    Show all 3 records →

Timeline

  1. 2026-11-08 Threatist record created from CVE-2026-123610
  2. 2026-11-08 Alias added: GHSA-gg47-62fq-vrhp

References

Advisory 1

  • TI-2026-63063 rustls-webpki before 0.103.13 Panic via empty BIT STRING CVSS 4.0HIGH 8.7
  • TI-2026-86755 Rustls accepts handshake messages at the wrong encryption level CVSS 4.0MEDIUM 6.9
  • TI-2026-86753 Key exchange downgrade in rustls via unauthenticated ServerHello CVSS 4.0MEDIUM 6.3
  • TI-2024-21532 Rustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client input CVSS 3.1HIGH 7.5
  • TI-2026-86754 Application data sent to public_name server when rustls rejects ECH CVSS 4.0MEDIUM 4.6
  • TI-2026-86751 Secret key material exposed through Debug formatting in Rustls CVSS 4.0MEDIUM 4.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences