RUSTSEC-2026-0348: Brotli certificate decompression can allocate up to 1 GiB before authentication
还没有人认领这个 Issue。
评估
调研方向
The payload names the rustls dependency at 0.23.45 with a patched version of at least 0.23.46, but not where it is declared. Start by searching Cargo.toml and Cargo.lock for rustls, and check whether the brotli feature is enabled anywhere. Done when the lock resolves to a patched rustls and the project builds and its tests pass; cargo audit should no longer report RUSTSEC-2026-0348.
由索引模型根据 Issue 内容生成。
描述
Brotli certificate decompression can allocate up to 1 GiB before authentication
| Details | |
|---|---|
| Package | rustls |
| Version | 0.23.45 |
| URL | https://github.com/rustls/rustls/pull/3297 |
| Date | 2026-10-14 |
| Patched versions | >=0.23.46 |
| Unaffected versions | <0.23.9 |
The built-in Brotli certificate decompressor (enabled by the non-default
brotli crate feature) bounded the size of the decompressed output, but
accepted a peer-selected history window. Brotli's large-window extension was
enabled, so a five-byte header could cause an allocation of 1 GiB. A peer can
abort a process whose allocator cannot satisfy that request.
No trusted certificate is required by the attacker. Affected configurations are:
- clients that enable the
brotlifeature and connect to a malicious server, and - servers that enable the
brotlifeature and request client certificates.
Applications that do not enable the brotli feature are not affected.
See advisory page for additional details.
- 主要语言
- Rust
- 星标
- 1
- 派生
- 0
- 平均合并
- 1 天 15 小时
- 30 天内合并 PR
- 3
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
stackabletech/stackable-odbc-trino 的其他 Issue
-
难度 1/5 1-3 小时 新手友好度 62/100
-
难度 1/5 1 小时以内 新手友好度 65/100
-
难度 2/5 1-3 小时 新手友好度 55/100
-
难度 5/5 一周以上 新手友好度 15/100
-
难度 4/5 3-5 天 新手友好度 35/100
查看 stackabletech/stackable-odbc-trino 的全部 Issue
相似的 Issue
-
build: Update rust version可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭dependencies
难度 2/5 1-3 小时 新手友好度 67/100
ibm-granite-community/granite-cli#229 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100
orottier/web-audio-api-rs#658 ·
-
难度 2/5 1-3 小时 新手友好度 84/100
aosama/astronomical#1318 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 66/100
shep-pm/shep-kelpie#980 ·
维护者通常 1 天内回复