# GHSA-h2v8-394m-p7vv: The built-in (but disabled by default) Brotli certificate decoder bounds the output buffer but accepts an input-selected history window.


- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Fix available:** Yes
- **Published:** 14 Oct 2026
- **Also known as:** RUSTSEC-2026-0348

## What is GHSA-h2v8-394m-p7vv?

GHSA-h2v8-394m-p7vv is a vulnerability in rustls, published on 14 Oct 2026. 

### Official description

### Summary

The built-in (but disabled by default) Brotli certificate decoder bounds the output buffer but accepts an input-selected history window. A header of five bytes can specify a 1 GiB window allocation. A peer can abort a process whose allocator cannot satisfy that request. A client must enable Brotli and connect to the peer; a server must enable Brotli and request a client certificate. Neither direction requires a trusted attacker certificate.

### Details

rustls calls `BrotliDecompress` which enables Brotli's large-window extension. rustls applies a limit to certificates, but this applies to the decompressed result, and not to any internal allocations the process requires.

### Impact

Client applications that enable the `brotli` feature will be vulnerable to malicious servers. Server applications that enable the `brotli` feature and enable client authentication will be vulnerable to malicious clients.

Potential for denial of service due to memory exhaustion from peers sending malicious Brotli-encoded certificates, for applications that enable Brotli decompression.

### Acknowledgement
Thanks to OpenAI [OutboundDisclosures@openai.com](mailto:OutboundDisclosures@openai.com) for the disclosure.

## Which versions are affected by GHSA-h2v8-394m-p7vv?

5 open source packages ship an affected version, including rustls.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `rustls` | crates.io | All versions | 0.23.46 |
| `rustls` | crates.io | All versions | 0.23.46 |
| `rustls` | crates.io | From 0.23.9 | 0.23.46 |
| `rustls` | crates.io | From 0.24.0-dev.1 | 0.24.0-dev.2 |
| `rustls` | crates.io | From 0.24.0-dev.1 | 0.24.0-dev.2 |

## How do I fix GHSA-h2v8-394m-p7vv?

Upgrade rustls to a fixed version for your release line: 0.23.46 or 0.24.0-dev.2.

## Is GHSA-h2v8-394m-p7vv being exploited?

There is no known exploitation of GHSA-h2v8-394m-p7vv in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-h2v8-394m-p7vv and fix it if it is affected.

What it is: GHSA-h2v8-394m-p7vv is a vulnerability in rustls, published on 14 Oct 2026. 
Exploitation: There is no known exploitation of GHSA-h2v8-394m-p7vv in the wild and no public exploit code.

Affected packages and fixed versions:
- rustls (crates.io): affected all versions; fixed in 0.23.46
- rustls (crates.io): affected all versions; fixed in 0.23.46
- rustls (crates.io): affected from 0.23.9; fixed in 0.23.46
- rustls (crates.io): affected from 0.24.0-dev.1; fixed in 0.24.0-dev.2
- rustls (crates.io): affected from 0.24.0-dev.1; fixed in 0.24.0-dev.2

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-h2v8-394m-p7vv/ (Markdown: https://insights.sbomify.com/GHSA-h2v8-394m-p7vv/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-h2v8-394m-p7vv

---
From sbomify Insights: https://insights.sbomify.com/GHSA-h2v8-394m-p7vv/
Summaries are generated and may contain mistakes; the official description above is the record.