GHSA-fc83-9jwq-gc2m: 
Rust vulnerability analysis and mitigation

The vulnerability (GHSA-fc83-9jwq-gc2m) affects the web-push crate in Rust, impacting versions prior to 0.10.4. Discovered and disclosed in March 2025, this vulnerability allows malicious Web Push endpoints to cause denial of service through memory exhaustion. The issue stems from the built-in clients of the web-push crate eagerly allocating memory based on the Content-Length header returned by Web Push endpoints (GitHub Advisory, RustSec Advisory).

The vulnerability is classified as moderate severity with a CVSS score of 6.9. The technical issue involves the crate's handling of Content-Length headers from Web Push endpoints. Prior to version 0.10.3, the system would allocate memory based on the Content-Length header without verifying the actual data size, making it susceptible to memory exhaustion attacks. The vulnerability is particularly concerning because Web Push notification services typically allow users to register arbitrary endpoints, which should not be trusted (GitHub Advisory).

When exploited, this vulnerability can lead to denial of service through memory exhaustion. Since the system allocates memory based on the claimed Content-Length without verification, a malicious endpoint could specify a large Content-Length without actually sending the corresponding amount of data, potentially causing the system to run out of memory (RustSec Advisory).

The vulnerability is exploitable over the network with low attack complexity and requires no special privileges or user interaction. The attack vector is particularly concerning as it can be triggered through any untrusted Web Push endpoint, making it relatively straightforward to exploit in systems that allow users to register arbitrary endpoints (GitHub Advisory).

The vulnerability has been patched in version 0.10.4. The fix implemented in version 0.10.3 includes limiting the amount of memory allocated for each response, restricting the amount of data read from the endpoint, and returning an error if the endpoint sends too much data. It is recommended that services implement timeouts for each request to Web Push endpoints as an additional security measure (RustSec Advisory).