GitHub Advisoryadvisory · crates.io
GHSA-287x-9rff-qvcg Rust Web Push is vulnerable to a DoS attack via a large integer in a Content-Length header
MEDIUM
Official page ↗
- Aliases
- CVE-2025-53604
- Ecosystem
- crates.io
- Packages
- web-push
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L
- Weaknesses
- CWE-130
- Reviewed
- 2025-07-07
Affected packages
• crates.io web-push: < 0.10.4 → fixed in 0.10.4
Description
The web-push crate before 0.10.4 for Rust allows a denial of service (memory consumption) in the built-in clients via a large integer in a Content-Length header. The patch was initially made available in version 0.10.3, but version 0.10.3 has since been yanked.
Related
Alias · CVE (1)
- CVE-2025-53604 The web-push crate before 0.10.3 for Rust allows a denial of service (memory consumption) in the built-in clients via a large integer in a… vulnerability
Weakness · CWE (1)
- CWE-130 Improper Handling of Length Parameter Inconsistency weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-53604 advisory
- https://github.com/pimeys/rust-web-push/pull/68 web
- https://github.com/pimeys/rust-web-push/commit/8447ed86bf3f24629abd7022b94104bf3cd64453 web
- https://crates.io/crates/web-push web
- https://github.com/pimeys/rust-web-push package
- https://rustsec.org/advisories/RUSTSEC-2025-0015.html web