Zero Radar
← feed
LowVulnerabilityGHSA-h2v8-394m-p7vvupdated 27 Oct 2026, 16:08 UTC

Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.

Fixed in rustls 0.23.46, rustls 0.24.0-dev.2Official source
SeverityLowCVSS 3.7 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesrustls 0.23.46, rustls 0.24.0-dev.2 · since 27 Oct 2026
How sure is this?Official sourceBacked by an official source

Are you affected?

Package / productAffected versionsFixed in
rustls · rust< 0.23.460.23.46
rustls · rust>= 0.24.0-dev.1, < 0.24.0-dev.20.24.0-dev.2

Timeline

  1. 27 Oct 2026, 16:08 UTC
    Publicly disclosed
  2. 27 Oct 2026, 16:08 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 27 Oct 2026, 16:08 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
GHSA-h2v8-394m-p7vv
CVSS
3.7 / 10
Disclosed
27 Oct 2026, 16:08 UTC
On Zero Radar
27 Oct 2026, 16:08 UTC (0 min after disclosure)
Last change
27 Oct 2026, 16:08 UTC

This entry has not been explained yet. The text comes straight from the source. How Zero Radar works

Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication. · Zero Radar