UBUNTU-CVE-2026-123610: Medium severity ubuntu/rust-rustls vulnerability
rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a certificate with a five-byte Brotli header requesting up to 1 GiB before authentication, aborting Brotli-enabled clients or client-authenticating servers whose allocator cannot satisfy the request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rustlsto a version that resolves this vulnerability.Fixed in 0.23.46
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only rustls deployments with optional Brotli certificate decompression enabled are affected. This includes Brotli-enabled clients and servers that request client certificates, because the malicious certificate can be processed before authentication.
What does an attacker need to do to trigger the problem?
An unauthenticated malicious peer can send a certificate containing a five-byte Brotli header that requests a history window of up to 1 GiB. Exploitation requires the target allocator to be unable to satisfy that allocation request.
What is the practical impact?
The issue can abort affected clients or client-authenticating servers, resulting in a denial of service. The provided severity vector indicates no confidentiality or integrity impact.