GHSA-h2v8-394m-p7vv

Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.

Low highest severity reported

catalog tools match this advisory

ship the vulnerable code in their release binary (Go tools analyzed with govulncheck)

in the CISA KEV catalog

Catalog tools matching GHSA-h2v8-394m-p7vv

Tool	Version scanned	Package	Fixed in	Released binary	Declared in or found in	Dispute
cargo-audit Static Application Security Testing (SAST) › Language-specific › Rust	cargo-audit/v0.22.2	`rustls@0.23.40` cargo	0.23.46	not analyzed	`Cargo.lock`	Dispute
zizmor Infrastructure as Code Security	v1.31.1	`rustls@0.23.34` cargo	0.23.46	not analyzed	`Cargo.lock`	Dispute

Vulnerabilities are known advisories that Grype matches against the dependencies declared in each project's release source (manifests and lockfiles, including development and build dependencies). A match does not mean the tool is exploitable: the vulnerable code may be unused, test-only, or not shipped in the released binary. KEV: listed in the CISA Known Exploited Vulnerabilities catalog. EPSS: FIRST's estimated probability of exploitation in the next 30 days. Both describe the vulnerability in general, not its exploitability through this tool; a match in a workflow file refers to a GitHub Action, not to shipped code. Released binary is only analyzed for Go tools with a Linux release binary; other tools show not analyzed.

Advisory sources

GitHub advisory GHSA-h2v8-394m-p7vv · OSV GHSA-h2v8-394m-p7vv

Grype data sources: https://github.com/advisories/GHSA-h2v8-394m-p7vv