CVE-2025-53604 Details

A denial-of-service vulnerability has been identified in the web-push crate for Rust, prior to version 0.10.3. This issue allows memory exhaustion in the built-in clients by sending a large integer in the Content-Length header. The vulnerability arises because the clients allocate memory based on the Content-Length value, which can be manipulated by malicious Web Push endpoints. Such endpoints can be registered arbitrarily by users, making this a significant concern.

Users of the web-push crate should update to version 0.10.3 or later, where this vulnerability has been patched. It is also recommended to implement a timeout for requests to Web Push endpoints.