Allocation of Resources Without Limits or Throttling Affecting web-push package, versions <0.10.4
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUST-WEBPUSH-9513021
- published25 Mar 2025
- disclosed24 Mar 2025
- creditUnknown
Introduced: 24 Mar 2025
New CVE NOT AVAILABLE CWE-405 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade web-push to version 0.10.4 or higher.
Overview
web-push is a web push notification client with support for http-ece encryption and VAPID authentication
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling when processing very large responses in hyper_client.rs, due to the handling of Content-Length headers. An attacker can exhaust memory by sending malicious headers.