CVE-2026-123610
Received Received - Intake

Memory Allocation Flaw in rustls Brotli Decompression

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a certificate with a five-byte Brotli header requesting up to 1 GiB before authentication, aborting Brotli-enabled clients or client-authenticating servers whose allocator cannot satisfy the request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123610
EUVD
EUVD-2026-119369

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rustls rustls to 0.23.46 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability is in rustls before version 0.23.46, where an uncontrolled memory allocation flaw exists in the optional Brotli certificate decompression feature. It allows malicious peers to send a certificate with a Brotli header requesting up to 1 GiB of memory before authentication, potentially causing clients or servers to abort if memory allocation fails.

Impact Analysis

This vulnerability can impact you by causing denial-of-service conditions. If you use rustls with Brotli decompression enabled, an attacker could send a specially crafted certificate to exhaust memory resources, leading to crashes or service disruptions in your application.

Mitigation Strategies

Update rustls to version 0.23.46 or later to address the uncontrolled memory allocation flaw in Brotli certificate decompression.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123610. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...