Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🦀
🦀 crates.io
Not in CISA KEV
LOW severity

Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authenticationGHSA-h2v8-394m-p7vv

LOWFix: rustls/rustls#3297

GHSA-h2v8-394m-p7vv is a low-severity (CVSS 3.7) vulnerability in rustls. A fix is available for rustls — see the affected versions and patch details below.

Also known asRUSTSEC-2026-0348
Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Oct 27, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

2 pkgs affected
🦀rustls🦀rustls

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.

Description

Summary

The built-in (but disabled by default) Brotli certificate decoder bounds the output buffer but accepts an input-selected history window. A header of five bytes can specify a 1 GiB window allocation. A peer can abort a process whose allocator cannot satisfy that request. A client must enable Brotli and connect to the peer; a server must enable Brotli and request a client certificate. Neither direction requires a trusted attacker certificate.

Details

rustls calls BrotliDecompress which enables Brotli's large-window extension. rustls applies a limit to certificates, but this applies to the decompressed result, and not to any internal allocations the process requires.

Impact

Client applications that enable the brotli feature will be vulnerable to malicious servers. Server applications that enable the brotli feature and enable client authentication will be vulnerable to malicious clients.

Potential for denial of service due to memory exhaustion from peers sending malicious Brotli-encoded certificates, for applications that enable Brotli decompression.

Acknowledgement

Thanks to OpenAI [email protected] for the disclosure.

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
🦀crates.iorustlsall versions0.23.46cargo update -p rustls --precise 0.23.46
🦀crates.iorustls≥ 0.24.0-dev.1&&< 0.24.0-dev.20.24.0-dev.2cargo update -p rustls --precise 0.24.0-dev.2

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for rustls, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update rustls to 0.23.46 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-h2v8-394m-p7vv is resolved across your whole dependency graph.

  3. Workarounds

    Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.

Frequently Asked Questions

### Summary The built-in (but disabled by default) Brotli certificate decoder bounds the output buffer but accepts an input-selected history window. A header of five bytes can specify a 1 GiB window allocation. A peer can abort a process whose allocator cannot satisfy that request. A client must enable Brotli and connect to the peer; a server must enable Brotli and request a client certificate. Neither direction requires a trusted attacker certificate. ### Details rustls calls `BrotliDecompress` which enables Brotli's large-window extension. rustls applies a limit to certificates, but this
O3 Security · Impact-Aware SCA

Is GHSA-h2v8-394m-p7vv in your dependencies?

Find it across crates.io, including transitive dependencies.

Scan my dependencies How O3 SCA works
Rustls: Brotli certificate decompression can allocate an…