Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.7
rustls Brotli feature can cause 1 GB memory allocation
published 4 days ago
Summary
If you enable the Brotli option in rustls, a malicious server or client can trigger a request for up to 1 GB of memory during certificate handling. This can cause the process to run out of memory and stop working. Disable the Brotli feature unless you need it, or apply the vendor’s update that limits the allocation size.
What to do
- Update ctz rustls to version 0.23.46.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| crates.io | ctz | rustls |
>= 0.23.9, < 0.23.46 Fix: upgrade to 0.23.46
|
Original advisory text
Brotli certificate decompression can allocate up to 1 GiB before authentication
The built-in Brotli certificate decompressor (enabled by the non-default
`brotli` crate feature) bounded the size of the decompressed output, but
accepted a peer-selected history window. Brotli's large-window extension was
enabled, so a five-byte header could cause an allocation of 1 GiB. A peer can
abort a process whose allocator cannot satisfy that request.
No trusted certificate is required by the attacker. Affected configurations are:
- clients that enable the `brotli` feature and connect to a malicious server, and
- servers that enable the `brotli` feature and request client certificates.
Applications that do not enable the `brotli` feature are not affected.
`brotli` crate feature) bounded the size of the decompressed output, but
accepted a peer-selected history window. Brotli's large-window extension was
enabled, so a five-byte header could cause an allocation of 1 GiB. A peer can
abort a process whose allocator cannot satisfy that request.
No trusted certificate is required by the attacker. Affected configurations are:
- clients that enable the `brotli` feature and connect to a malicious server, and
- servers that enable the `brotli` feature and request client certificates.
Applications that do not enable the `brotli` feature are not affected.
References
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published14 Oct 2026
Updated14 Oct 2026
First seen14 Oct 2026
Track software like this
Free during beta