CVE-2026-123610— rustls before 0.23.46 Denial of Service via Brotli Certificate Decompression

Quick assessment

Affected

rustls rustls

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 0.23.46 版本之前的 rustls 中，其可选的 Brotli 证书解压缩功能存在一个不受控的内存分配漏洞。该功能虽然限制了输出数据的解压缩后大小，但却允许输入方选择一个过大的历史窗口。恶意对等方可发送一个包含五字节 Brotli 头的证书，在身份验证之前请求高达 1 GiB 的内存，从而导致启用 Brotli 的客户端或依赖客户端认证的服务器因内存分配器无法满足该请求而中止运行。

CVSS 3.7 · Low Updated Nov 08, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

rustls before 0.23.46 Denial of Service via Brotli Certificate Decompression

Source: CVE Program / CVE List V5

Vulnerability Description

rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a certificate with a five-byte Brotli header requesting up to 1 GiB before authentication, aborting Brotli-enabled clients or client-authenticating servers whose allocator cannot satisfy the request.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

不加限制或调节的资源分配

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
rustls	rustls	0 ~ 0.23.46	-

II. Public POCs for CVE-2026-123610

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123610

请登录查看更多情报信息。

Other References for CVE-2026-123610 (2)

https://github.com/rustls/rustls/security/advisories/GHSA-h2v8-394m-p7vv vendor-advisory
https://www.vulncheck.com/advisories/rustls-before-0.23.46-denial-of-service-via-brotli-certificate-decompression third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-123610

Same Patch Batch · rustls · 2026-11-08 · 5 CVEs total

CVE-2026-123613	5.3 MEDIUM	Rustls 0.23.13 before 0.23.45 TLS 1.3 Handshake Encryption Level Bypass
CVE-2026-123609	4.0 MEDIUM	Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 Secret Exposure via Debug
CVE-2026-123611	3.7 LOW	rustls before 0.23.46 Key Exchange Downgrade via Unauthenticated ServerHello
CVE-2026-123612	2.3 LOW	rustls 0.23.44 and 0.23.45 ECH Rejection Application Data Disclosure

IV. Related Vulnerabilities

Same product: rustls

Same vendor: rustls

Same weakness: CWE-770