Description
The web-push crate before 0.10.3 for Rust allows a denial of service (memory consumption) in the built-in clients via a large integer in a Content-Length header.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pimeys | web-push | < 0.10.3 | 0.10.3 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | web-push | < 0.10.4 | 0.10.4 | GHSA-287x-9rff-qvcg |
| crates.io | web-push | >= 0.0.0-0, < 0.10.3 | 0.10.3 | RUSTSEC-2025-0015 |