Memory Allocation Vulnerability in Rustls Affected by Brotli Certificate Decompression
CVE-2026-123610

6.3MEDIUM

Key Information:

Vendor

Rustls

Status
Rustls
Vendor
CVE Published:
8 November 2026

What is CVE-2026-123610?

Rustls, prior to version 0.23.46, is susceptible to a memory allocation flaw related to its optional Brotli certificate decompression feature. This vulnerability allows malicious actors to exploit the decompression process by sending specially crafted certificates. These certificates can trigger excessive memory requests, potentially overwhelming clients or servers that utilize Brotli compression. As a result, an attacker can disrupt services through denial of service, affecting authentication processes and leading to system instability.

Affected Version(s)

rustls 0 < 0.23.46

rustls 0.23.46

References

https://github.com/rustls/rustls/security/advisories/GHSA...
vendor-advisory
https://www.vulncheck.com/advisories/rustls-before-0.23.4...
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.