https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-08T21:06:10.798021+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cleanstart-2026-qo07216 CLEANSTART-2026-QO07216 — Security fix for GHSA-h2v8-394m-p7vv applied in: rustup 1.28.2-r4 2026-11-08T21:06:10.799124+00:00

Affected: CleanStart: rustup

Security vulnerability affects the rustup package. This issue is resolved in later releases. See references for vulnerability details.

 https://db.gcve.eu/vuln/rustsec-2026-0348 RUSTSEC-2026-0348 — Brotli certificate decompression can allocate up to 1 GiB before authentication 2026-11-08T21:06:10.799185+00:00

Affected: crates.io: rustls

The built-in Brotli certificate decompressor (enabled by the non-default `brotli` crate feature) bounded the size of the decompressed output, but accepted a peer-selected history window. Brotli's large-window extension was enabled, so a five-byte header could cause an allocation of 1 GiB. A peer can abort a process whose allocator cannot satisfy that request.

No trusted certificate is required by the attacker. Affected configurations are:

- clients that enable the `brotli` feature and connect to a malicious server, and - servers that enable the `brotli` feature and request client certificates.

Applications that do not enable the `brotli` feature are not affected.