Stream: git-wasmtime

Topic: wasmtime / issue #14761 RUSTSEC-2026-0348: Brotli certifi...

view this post on Zulip Wasmtime GitHub notifications bot (Oct 15 2026 at 00:13):

github-actions[bot] opened issue #14761:

Brotli certificate decompression can allocate up to 1 GiB before authentication

Details
Package rustls
Version 0.23.45
URL https://github.com/rustls/rustls/pull/3297
Date 2026-10-14
Patched versions >=0.23.46
Unaffected versions <0.23.9

The built-in Brotli certificate decompressor (enabled by the non-default
brotli crate feature) bounded the size of the decompressed output, but
accepted a peer-selected history window. Brotli's large-window extension was
enabled, so a five-byte header could cause an allocation of 1 GiB. A peer can
abort a process whose allocator cannot satisfy that request.

No trusted certificate is required by the attacker. Affected configurations are:

Applications that do not enable the brotli feature are not affected.

See advisory page for additional details.

view this post on Zulip Wasmtime GitHub notifications bot (Oct 15 2026 at 14:50):

alexcrichton closed issue #14761:

Brotli certificate decompression can allocate up to 1 GiB before authentication

Details
Package rustls
Version 0.23.45
URL https://github.com/rustls/rustls/pull/3297
Date 2026-10-14
Patched versions >=0.23.46
Unaffected versions <0.23.9

The built-in Brotli certificate decompressor (enabled by the non-default
brotli crate feature) bounded the size of the decompressed output, but
accepted a peer-selected history window. Brotli's large-window extension was
enabled, so a five-byte header could cause an allocation of 1 GiB. A peer can
abort a process whose allocator cannot satisfy that request.

No trusted certificate is required by the attacker. Affected configurations are:

Applications that do not enable the brotli feature are not affected.

See advisory page for additional details.

Last updated: Oct 31 2026 at 23:03 UTC