Denial of Service Vulnerability in Rust's Web Push Clients

CVE-2025-53604

What is CVE-2025-53604?

The web-push crate for Rust, prior to version 0.10.3, is susceptible to a denial of service attack where a crafted large integer in the Content-Length header can lead to excessive memory consumption in built-in clients. This vulnerability could allow attackers to exhaust server resources, impacting the availability of services utilizing the affected crate. Developers are encouraged to upgrade to the latest version to mitigate this risk.

References