RUSTSEC-2026-0348: Brotli certificate decompression can allocate up to 1 GiB before authentication
還沒有人認領這個 Issue。
評估
研究方向
The payload names the rustls dependency at 0.23.45 with a patched version of at least 0.23.46, but not where it is declared. Start by searching Cargo.toml and Cargo.lock for rustls, and check whether the brotli feature is enabled anywhere. Done when the lock resolves to a patched rustls and the project builds and its tests pass; cargo audit should no longer report RUSTSEC-2026-0348.
由索引模型根據 Issue 內容生成。
描述
Brotli certificate decompression can allocate up to 1 GiB before authentication
| Details | |
|---|---|
| Package | rustls |
| Version | 0.23.45 |
| URL | https://github.com/rustls/rustls/pull/3297 |
| Date | 2026-10-14 |
| Patched versions | >=0.23.46 |
| Unaffected versions | <0.23.9 |
The built-in Brotli certificate decompressor (enabled by the non-default
brotli crate feature) bounded the size of the decompressed output, but
accepted a peer-selected history window. Brotli's large-window extension was
enabled, so a five-byte header could cause an allocation of 1 GiB. A peer can
abort a process whose allocator cannot satisfy that request.
No trusted certificate is required by the attacker. Affected configurations are:
- clients that enable the
brotlifeature and connect to a malicious server, and - servers that enable the
brotlifeature and request client certificates.
Applications that do not enable the brotli feature are not affected.
See advisory page for additional details.
- 主要語言
- Rust
- 星號
- 2
- 分支
- 0
- 平均合併
- 1 天 15 小時
- 30 天內合併 PR
- 3
環境準備
- 沒有 Dockerfile 或 Docker Compose 檔案
- 有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
stackabletech/stackable-odbc-trino 的其他 Issue
-
難度 1/5 1-3 小時 新手友好度 62/100
-
難度 1/5 1 小時以內 新手友好度 65/100
-
難度 2/5 1-3 小時 新手友好度 55/100
-
難度 5/5 一週以上 新手友好度 15/100
-
難度 4/5 3-5 天 新手友好度 35/100
查看 stackabletech/stackable-odbc-trino 的全部 Issue
相似的 Issue
-
難度 2/5 1-3 小時 新手友好度 78/100
EmbarkStudios/cargo-deny#910 ·
-
難度 2/5 1-3 小時 新手友好度 68/100
tursodatabase/turso#10054 ·
維護者通常 1 天內回覆
-
build: Update rust version可能已有人在做 關聯的 PR 仍在進行中或已合併。 未關閉dependencies
難度 2/5 1-3 小時 新手友好度 67/100
ibm-granite-community/granite-cli#229 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 82/100
維護者通常 2 天內回覆
-
難度 2/5 1-3 小時 新手友好度 78/100
orottier/web-audio-api-rs#658 ·