{"answers":{"affected":"5 open source packages ship an affected version, including rustls.","exploited":"There is no known exploitation of GHSA-h2v8-394m-p7vv in the wild and no public exploit code.","fix":"Upgrade rustls to a fixed version for your release line: 0.23.46 or 0.24.0-dev.2.","what":"GHSA-h2v8-394m-p7vv is a vulnerability in rustls, published on 14 Oct 2026."},"fix_prompt":"Check this codebase for GHSA-h2v8-394m-p7vv and fix it if it is affected.\n\nWhat it is: GHSA-h2v8-394m-p7vv is a vulnerability in rustls, published on 14 Oct 2026. \nExploitation: There is no known exploitation of GHSA-h2v8-394m-p7vv in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- rustls (crates.io): affected all versions; fixed in 0.23.46\n- rustls (crates.io): affected all versions; fixed in 0.23.46\n- rustls (crates.io): affected from 0.23.9; fixed in 0.23.46\n- rustls (crates.io): affected from 0.24.0-dev.1; fixed in 0.24.0-dev.2\n- rustls (crates.io): affected from 0.24.0-dev.1; fixed in 0.24.0-dev.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-h2v8-394m-p7vv/ (Markdown: https://insights.sbomify.com/GHSA-h2v8-394m-p7vv/index.md)","id":"GHSA-h2v8-394m-p7vv","markdown":"https://insights.sbomify.com/GHSA-h2v8-394m-p7vv/index.md","name":"GHSA-h2v8-394m-p7vv","record":{"aliases":["RUSTSEC-2026-0348"],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\n\nThe built-in (but disabled by default) Brotli certificate decoder bounds the output buffer but accepts an input-selected history window. A header of five bytes can specify a 1 GiB window allocation. A peer can abort a process whose allocator cannot satisfy that request. A client must enable Brotli and connect to the peer; a server must enable Brotli and request a client certificate. Neither direction requires a trusted attacker certificate.\n\n### Details\n\nrustls calls `BrotliDecompress` which enables Brotli's large-window extension. rustls applies a limit to certificates, but this applies to the decompressed result, and not to any internal allocations the process requires.\n\n### Impact\n\nClient applications that enable the `brotli` feature will be vulnerable to malicious servers. Server applications that enable the `brotli` feature and enable client authentication will be vulnerable to malicious clients.\n\nPotential for denial of service due to memory exhaustion from peers sending malicious Brotli-encoded certificates, for applications that enable Brotli decompression.\n\n### Acknowledgement\nThanks to OpenAI [OutboundDisclosures@openai.com](mailto:OutboundDisclosures@openai.com) for the disclosure.","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"The built-in (but disabled by default) Brotli certificate decoder bounds the output buffer but accepts an input-selected history window.","id":"GHSA-h2v8-394m-p7vv","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":null,"year":"2026"},"n_packages":5,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["0.23.46"],"introduced":["0"],"last_affected":[],"package":"rustls","purl":null,"source":"GHSA-h2v8-394m-p7vv"},{"ecosystem":"crates.io","fixed":["0.23.46"],"introduced":["0"],"last_affected":[],"package":"rustls","purl":"pkg:cargo/rustls","source":"GHSA-h2v8-394m-p7vv"},{"ecosystem":"crates.io","fixed":["0.23.46"],"introduced":["0.23.9"],"last_affected":[],"package":"rustls","purl":"pkg:cargo/rustls","source":"RUSTSEC-2026-0348"},{"ecosystem":"crates.io","fixed":["0.24.0-dev.2"],"introduced":["0.24.0-dev.1"],"last_affected":[],"package":"rustls","purl":null,"source":"GHSA-h2v8-394m-p7vv"},{"ecosystem":"crates.io","fixed":["0.24.0-dev.2"],"introduced":["0.24.0-dev.1"],"last_affected":[],"package":"rustls","purl":"pkg:cargo/rustls","source":"GHSA-h2v8-394m-p7vv"}],"products":null,"published":"2026-10-14","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"open","licence":"CC0 1.0","name":"RustSec","prefix":"RUSTSEC"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/GHSA-h2v8-394m-p7vv/"}