pimeys/rust-web-push · Security
Rust Web Push is vulnerable to a DoS attack via a large integer in a Content-Length header
- GHSA ID
- GHSA-287x-9rff-qvcg
- CVE ID
- CVE-2025-53604
- Severity
- medium
- Published
- Updated
- CVSS
- 4 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L
- CVSS v3
- 4 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L
Description
The web-push crate before 0.10.4 for Rust allows a denial of service (memory consumption) in the built-in clients via a large integer in a Content-Length header. The patch was initially made available in version 0.10.3, but version 0.10.3 has since been yanked.
CWEs
- CWE-130 · Improper Handling of Length Parameter Inconsistency
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-53604 ↗
- https://github.com/pimeys/rust-web-push/pull/68 ↗
- https://crates.io/crates/web-push ↗
- https://rustsec.org/advisories/RUSTSEC-2025-0015.html ↗
- https://github.com/pimeys/rust-web-push/commit/8447ed86bf3f24629abd7022b94104bf3cd64453 ↗
- https://github.com/advisories/GHSA-287x-9rff-qvcg ↗