Debian Rust Security Tracker 🩺🦀

RUSTSEC-2026-0348: Brotli certificate decompression can allocate up to 1 GiB before authentication

low 44 affected
Crate
rustls
Patched Versions
>=0.23.46
Debian Version
0.23.45+ds-1
0.21.12-15
Debian Bugs
—
Issued
2026-10-14
Aliases
GHSA-h2v8-394m-p7vv
Patched:Affected

The built-in Brotli certificate decompressor (enabled by the non-default brotli crate feature) bounded the size of the decompressed output, but accepted a peer-selected history window. Brotli's large-window extension was enabled, so a five-byte header could cause an allocation of 1 GiB. A peer can abort a process whose allocator cannot satisfy that request.

No trusted certificate is required by the attacker. Affected configurations are:

  • clients that enable the brotli feature and connect to a malicious server, and
  • servers that enable the brotli feature and request client certificates.

Applications that do not enable the brotli feature are not affected.

Affected Packages

rustls 0.23.45 acme-redirect 0.8.1+dfsg-3+b3
rustls 0.23.45 apt-swarm 0.6.0-2+b3
rustls 0.23.45 apt-transport-blob 1.2.2-1+b2
rustls 0.23.45 bmap-rs 0.2.3-1
rustls 0.23.45 cargo-audit 0.22.2-1+b3
rustls 0.23.45 css-inline 0.22.0-1
rustls 0.23.45 debian-lsp 0.1.8-5+b2
rustls 0.23.45 debian-repro-status 0.4.0-3
rustls 0.23.45 gpg-sq 0.13.1-14+b2
rustls 0.23.45 gpgv-sq 0.13.1-14+b2
rustls 0.23.45 hickory-dns 0.26.3-1+b2
rustls 0.23.45 hussh 0.2.3-1
rustls 0.23.45 hypothesis-client 0.12.0-4+b3
rustls 0.23.45 icu4x-datagen 2.2.0-1+b2
affected ⚠️ librust-rustls-dev 0.23.45+ds-1
rustls 0.23.45 miniserve 0.35.0-5+b2
rustls 0.23.45 nethsm-pkcs11 2.0.0-3+b2
rustls 0.23.45 ntpd-rs 1.9.0-1+b2
rustls 0.23.45 ntpd-rs-metrics 1.9.0-1+b2
rustls 0.23.45 numbat 1.24.0-1
rustls 0.23.45 ognibuild 0.2.19-2+b2
rustls 0.23.45 patch-hub 0.1.7-3+b2
rustls 0.23.45 protonup-rs 0.15.0-1+b2
rustls 0.23.45 prr 0.21.0-2+b2
rustls 0.23.45 python3-taskchampion-py 2.0.2-5+b2
rustls 0.23.45 rbw 1.15.0-2+b2
rustls 0.23.45 rebuildctl 0.28.0-1+b2
rustls 0.23.45 rebuilderd 0.28.0+ds-2+b2
rustls 0.23.45 rebuilderd-worker 0.28.0-1+b2
rustls 0.23.45 repro-env 0.4.4+dfsg-3+b3
rustls 0.23.45 repro-threshold 0.1.2-1+b2
rustls 0.23.45 ripasso-cursive 0.8.0-1+b7
rustls 0.23.45 safe-vdash 0.20.0-6+b2
rustls 0.23.45 samply 0.13.1-1+b2
rustls 0.23.45 sccache 0.17.0+ds-3+b2
rustls 0.23.45 sequoia-git 0.6.0-2+b2
rustls 0.23.45 signal-tlsd 0.1.4-1+b2
rustls 0.23.45 silver-platter 0.8.4-2+b3
rustls 0.23.45 spytrap-adb 0.3.5-5+b2
rustls 0.23.45 sq 1.4.1-1
rustls 0.23.45 taskwarrior 3.5.0+dfsg-3+b2
rustls 0.23.45 tealdeer 1.9.0-1+b2
rustls 0.23.45 wasm-pack 0.15.0+ds-2+b2
rustls 0.23.45 xh 0.26.2-1+b2