CVE-2025-53604 Rust Web Push is vulnerable to a DoS attack via a large integer in a Content-Length header
A denial of service vulnerability in the Rust web-push library allows attackers to cause memory exhaustion via a large Content-Length header.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-53604?
CVE-2025-53604 is a medium-severity denial of service vulnerability in pimeys web-push, published on 5 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The web-push crate before 0.10.3 for Rust allows a denial of service (memory consumption) in the built-in clients via a large integer in a Content-Length header.
Weakness: CWE-130
Which versions are affected by CVE-2025-53604?
5 open source packages ship an affected version, including web-push.
| Package | Affected | Fixed in |
|---|---|---|
web-push crates.io | All versions | 0.10.4 |
web-push crates.io | All versions | 0.10.4 |
web-push crates.io | All versions | 0.10.4 |
web-push crates.io | All versions | 0.10.4 |
web-push crates.io | From 0.0.0-0 | 0.10.3 |
How do I fix CVE-2025-53604?
Upgrade web-push to a fixed version for your release line: 0.10.4 or 0.10.3.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-53604 being exploited?
There is no known exploitation of CVE-2025-53604 in the wild and no public exploit code.
Sources
Also known as GHSA-287x-9rff-qvcg, GHSA-fc83-9jwq-gc2m, RUSTSEC-2025-0015.