DEBIAN-CVE-2026-123610: Debian/rust-rustls vulnerability

Published Nov 8, 2026

Updated

rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a certificate with a five-byte Brotli header requesting up to 1 GiB before authentication, aborting Brotli-enabled clients or client-authenticating servers whose allocator cannot satisfy the request.

Affected Software

3 affected components

debian/rust-rustls*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rustls to a version that resolves this vulnerability.
Fixed in 0.23.46

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Clients with optional Brotli certificate decompression enabled are exposed when connecting to a malicious peer. Servers that use Brotli certificate decompression while authenticating clients are also exposed to malicious client certificates.

What does an attacker need to do to trigger the allocation?

The attacker needs to act as the peer and send a certificate containing a five-byte Brotli header that requests a large history window. This occurs before authentication, so the malicious peer does not need to authenticate first.

What is the impact if exploitation succeeds?

The affected process may attempt to allocate up to 1 GiB of memory. Clients or client-authenticating servers whose allocator cannot satisfy that request can abort.

Is Brotli support required for exposure?

Yes. The flaw is in optional Brotli certificate decompression, so deployments not using that capability are not described as affected.

DEBIAN-CVE-2026-123610: Debian/rust-rustls vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the allocation?

What is the impact if exploitation succeeds?

Is Brotli support required for exposure?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the allocation?

What is the impact if exploitation succeeds?

Is Brotli support required for exposure?