CVE-2026-123610: Security vulnerability

Published Nov 8, 2026

Updated

rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a certificate with a five-byte Brotli header requesting up to 1 GiB before authentication, aborting Brotli-enabled clients or client-authenticating servers whose allocator cannot satisfy the request.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rustls to a version that resolves this vulnerability.
Fixed in 0.23.46

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this denial of service?

Clients with Brotli certificate decompression enabled are exposed when connecting to a malicious peer. Servers that authenticate clients are also exposed if Brotli certificate decompression is enabled, because an unauthenticated client can provide the malicious certificate.

What does an attacker need to send to trigger the issue?

The attacker needs to send a certificate containing a five-byte Brotli header that requests a large history window. This can request up to 1 GiB of allocation before authentication.

Does limiting decompressed certificate output prevent exploitation?

No. The affected decompression path limits decompressed output size but still accepts an input-selected Brotli history window, which can cause the large allocation.

What is the impact if the allocation cannot be satisfied?

The Brotli-enabled client or client-authenticating server can abort when its allocator cannot satisfy the requested allocation.

CVE-2026-123610: Security vulnerability

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this denial of service?

What does an attacker need to send to trigger the issue?

Does limiting decompressed certificate output prevent exploitation?

What is the impact if the allocation cannot be satisfied?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial of service?

What does an attacker need to send to trigger the issue?

Does limiting decompressed certificate output prevent exploitation?

What is the impact if the allocation cannot be satisfied?