Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| rustls | rustls | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Sun, 08 Nov 2026 01:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a certificate with a five-byte Brotli header requesting up to 1 GiB before authentication, aborting Brotli-enabled clients or client-authenticating servers whose allocator cannot satisfy the request. | |
| Title | rustls before 0.23.46 Denial of Service via Brotli Certificate Decompression | |
| First Time appeared |
Rustls Project
Rustls Project rustls |
|
| Weaknesses | CWE-770 | |
| CPEs | cpe:2.3:a:rustls_project:rustls:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Rustls Project
Rustls Project rustls |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-11-08T01:38:35.478Z
Reserved: 2026-11-06T01:02:39.794Z
Link: CVE-2026-123610
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.