GHSA-287x-9rff-qvcgMediumCVSS 4.0

Rust Web Push is vulnerable to a DoS attack via a large integer in a Content-Length header

Published
July 5, 2025
Last Modified
July 7, 2025

🔗 CVE IDs covered (1)

📋 Description

The web-push crate before 0.10.4 for Rust allows a denial of service (memory consumption) in the built-in clients via a large integer in a Content-Length header. The patch was initially made available in version 0.10.3, but version 0.10.3 has since been yanked.

🎯 Affected products1

  • rust/web-push:<= 0.10.2

🔗 References (6)