RUSTSEC-2026-0348: Brotli certificate decompression can allocate up to 1 GiB before authentication
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 60/100
Research direction
The vulnerable dependency is rustls, pinned at 0.23.40 in Cargo.toml and resolved in Cargo.lock. Start by checking whether the brotli feature is enabled anywhere in the dependency tree (for example with cargo tree -e features -i rustls). Then raise the rustls requirement to at least 0.23.46 and regenerate the lockfile. Done when the lockfile shows a patched version and the build and tests still pass.
Written by the indexing model from the issue text.
Description
Brotli certificate decompression can allocate up to 1 GiB before authentication
| Details | |
|---|---|
| Package | rustls |
| Version | 0.23.40 |
| URL | https://github.com/rustls/rustls/pull/3297 |
| Date | 2026-10-14 |
| Patched versions | >=0.23.46 |
| Unaffected versions | <0.23.9 |
The built-in Brotli certificate decompressor (enabled by the non-default
brotli crate feature) bounded the size of the decompressed output, but
accepted a peer-selected history window. Brotli's large-window extension was
enabled, so a five-byte header could cause an allocation of 1 GiB. A peer can
abort a process whose allocator cannot satisfy that request.
No trusted certificate is required by the attacker. Affected configurations are:
- clients that enable the
brotlifeature and connect to a malicious server, and - servers that enable the
brotlifeature and request client certificates.
Applications that do not enable the brotli feature are not affected.
See advisory page for additional details.
- Dominant language
- Rust
- Stars
- 0
- Forks
- 2
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from stackabletech/postgresql-trino-gateway
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 1/5 Under an hour Newbie friendliness 55/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 55/100
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
All issues in stackabletech/postgresql-trino-gateway
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
wormhole-foundation/wormhole#5062 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 1-3 hours Newbie friendliness 62/100
-
core: Amount::from_str panics on values above 21M BTC instead of returning an errorPossibly taken @bhuvan-somisetty claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
crate: spate-s3
Difficulty 2/5 Half a day Newbie friendliness 62/100
Maintainers usually reply within 1 day
-
write_iceberg ignores the table's write.parquet.compression-codec propertyPossibly taken @YuangGao claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Eventual-Inc/Daft#7606 ·
Maintainers usually reply within 1 day