CVE-2025-53604: Medium severity Rust web-push vulnerability
The web-push crate before 0.10.3 for Rust allows a denial of service (memory consumption) in the built-in clients via a large integer in a Content-Length header.
Other sources
The web-push crate before 0.10.4 for Rust allows a denial of service (memory consumption) in the built-in clients via a large integer in a Content-Length header. The patch was initially made available in version 0.10.3, but version 0.10.3 has since been yanked.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-53604?
CVE-2025-53604 is classified as a denial of service vulnerability due to memory consumption issues.
How do I fix CVE-2025-53604?
To fix CVE-2025-53604, upgrade the web-push crate to version 0.10.3 or higher.
What causes CVE-2025-53604?
CVE-2025-53604 is caused by the handling of a large integer in the Content-Length header that leads to excessive memory usage.
Which software is affected by CVE-2025-53604?
CVE-2025-53604 affects the Rust web-push crate in versions prior to 0.10.3.
Can CVE-2025-53604 be exploited remotely?
Yes, CVE-2025-53604 can be exploited remotely through specially crafted requests targeting the affected web-push clients.