GHSA-h2v8-394m-p7vv: OpenAI Node Brotli cert decoder

Q: Is GHSA-h2v8-394m-p7vv actively exploited?

No confirmed active exploitation of GHSA-h2v8-394m-p7vv has been reported, but organizations should still patch proactively.

Q: How to fix GHSA-h2v8-394m-p7vv?

1) Upgrade rustls to 0.23.46 or later. 2) Run `cargo tree -e features -i rustls` to see whether the `brotli` feature is enabled, and disable it if it is not needed. 3) Update Cargo.lock and rebuild dependent binaries and container images. 4) Set container memory limits and restart policies to contain crashes. 5) Watch for unexplained process aborts or OOM kills during TLS handshakes. 6) Track RUSTSEC-2026-0348 in cargo-audit or cargo-deny pipelines.

Q: What systems are affected by GHSA-h2v8-394m-p7vv?

This vulnerability affects the following AI/ML architecture patterns: Model serving, Agent frameworks, LLM API clients, Inference gateways, mTLS-protected AI services.

Q: What is the CVSS score for GHSA-h2v8-394m-p7vv?

GHSA-h2v8-394m-p7vv has a CVSS v3.1 base score of 3.7 (LOW).

CISO Take

rustls, a widely used Rust TLS library, has a flaw in its optional Brotli certificate decompression: a five-byte header from a peer can force a 1 GiB history window allocation, which can crash a process that cannot satisfy it. This is low severity (CVSS 3.7), no EPSS score is available, there is no public exploit or Nuclei template, and it is not in CISA KEV, so urgency is modest. Exposure is limited to applications that explicitly enable the non-default `brotli` feature: clients are exposed to malicious servers, and servers are exposed only if they also request client certificates. The blast radius is still notable because 1,762 packages depend on it, including AI/LLM API clients and inference gateways that use rustls for outbound TLS. Upgrade to rustls 0.23.46 or later, and check whether the brotli feature is enabled in your Cargo builds.

Sources:GitHub AdvisoryNVDRustSecATLAS

What is the risk?

Low overall. The attack needs no privileges or user interaction and works over the network, but its complexity is high and the only impact is availability. Brotli is disabled by default, which sharply narrows exposure. There is no known exploitation, and no public exploit or scanner template. Risk rises for memory-constrained containers or services where a single process crash interrupts AI inference or API traffic.

How does the attack unfold?

Initial Access

The attacker operates or compromises a TLS peer that an application with Brotli enabled connects to, or connects to a server that requests client certificates.

AML.T0049

Exploitation

The peer sends a Brotli-compressed certificate whose five-byte header requests a 1 GiB history window.

AML.T0029

Impact

The allocator cannot satisfy the request, the process aborts, and the AI service becomes unavailable.

Initial Access

The attacker operates or compromises a TLS peer that an application with Brotli enabled connects to, or connects to a server that requests client certificates.

AML.T0049

Exploitation

The peer sends a Brotli-compressed certificate whose five-byte header requests a 1 GiB history window.

AML.T0029

Impact

The allocator cannot satisfy the request, the process aborts, and the AI service becomes unavailable.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenAI Node	cargo	< 0.23.46	`0.23.46`
11.2K1.8K dependentsPushed 7d ago56% patched~139d to patchFull package profile →

Do you use OpenAI Node? You're affected.

How severe is it?

CVSS 3.1

3.7 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRNone

UINone

SUnchanged

CNone

INone

ALow

What should I do?

1 step

1) Upgrade rustls to 0.23.46 or later. 2) Run cargo tree -e features -i rustls to see whether the brotli feature is enabled, and disable it if it is not needed. 3) Update Cargo.lock and rebuild dependent binaries and container images. 4) Set container memory limits and restart policies to contain crashes. 5) Watch for unexplained process aborts or OOM kills during TLS handshakes. 6) Track RUSTSEC-2026-0348 in cargo-audit or cargo-deny pipelines.

How is it classified?

DoSAPIInferenceFrameworkAML.T0010.001- AI Software AML.T0029- Denial of AI Service

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Response to unknown or newly identified risks

OWASP LLM Top 10

LLM10-Unbounded Consumption

Frequently Asked Questions

What is GHSA-h2v8-394m-p7vv?

rustls, a widely used Rust TLS library, has a flaw in its optional Brotli certificate decompression: a five-byte header from a peer can force a 1 GiB history window allocation, which can crash a process that cannot satisfy it. This is low severity (CVSS 3.7), no EPSS score is available, there is no public exploit or Nuclei template, and it is not in CISA KEV, so urgency is modest. Exposure is limited to applications that explicitly enable the non-default `brotli` feature: clients are exposed to malicious servers, and servers are exposed only if they also request client certificates. The blast radius is still notable because 1,762 packages depend on it, including AI/LLM API clients and inference gateways that use rustls for outbound TLS. Upgrade to rustls 0.23.46 or later, and check whether the brotli feature is enabled in your Cargo builds.

Is GHSA-h2v8-394m-p7vv actively exploited?

No confirmed active exploitation of GHSA-h2v8-394m-p7vv has been reported, but organizations should still patch proactively.

How to fix GHSA-h2v8-394m-p7vv?

1) Upgrade rustls to 0.23.46 or later. 2) Run `cargo tree -e features -i rustls` to see whether the `brotli` feature is enabled, and disable it if it is not needed. 3) Update Cargo.lock and rebuild dependent binaries and container images. 4) Set container memory limits and restart policies to contain crashes. 5) Watch for unexplained process aborts or OOM kills during TLS handshakes. 6) Track RUSTSEC-2026-0348 in cargo-audit or cargo-deny pipelines.

What systems are affected by GHSA-h2v8-394m-p7vv?

This vulnerability affects the following AI/ML architecture patterns: Model serving, Agent frameworks, LLM API clients, Inference gateways, mTLS-protected AI services.

What is the CVSS score for GHSA-h2v8-394m-p7vv?

GHSA-h2v8-394m-p7vv has a CVSS v3.1 base score of 3.7 (LOW).

What is the AI security impact?

Affected AI Architectures

Model servingAgent frameworksLLM API clientsInference gatewaysmTLS-protected AI services

MITRE ATLAS Techniques

AML.T0010.001AI Software

AML.T0029Denial of AI Service

Compliance Controls Affected

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

### Summary The built-in (but disabled by default) Brotli certificate decoder bounds the output buffer but accepts an input-selected history window. A header of five bytes can specify a 1 GiB window allocation. A peer can abort a process whose allocator cannot satisfy that request. A client must enable Brotli and connect to the peer; a server must enable Brotli and request a client certificate. Neither direction requires a trusted attacker certificate. ### Details rustls calls `BrotliDecompress` which enables Brotli's large-window extension. rustls applies a limit to certificates, but this applies to the decompressed result, and not to any internal allocations the process requires. ### Impact Client applications that enable the `brotli` feature will be vulnerable to malicious servers. Server applications that enable the `brotli` feature and enable client authentication will be vulnerable to malicious clients. Potential for denial of service due to memory exhaustion from peers sending malicious Brotli-encoded certificates, for applications that enable Brotli decompression. ### Acknowledgement Thanks to OpenAI [OutboundDisclosures@openai.com](mailto:OutboundDisclosures@openai.com) for the disclosure.

Exploitation Scenario

An attacker controls or compromises an upstream endpoint that a Rust-based AI agent or LLM gateway connects to, with Brotli certificate compression enabled on the client. During the TLS handshake the server sends a compressed certificate whose five-byte Brotli header declares a 1 GiB window. The client attempts the allocation, the allocator fails and the process aborts, repeatedly knocking the AI service offline. In the mTLS server case, an anonymous client presents a similarly crafted certificate to crash the inference gateway.

Weaknesses (CWE)

CWE-770Allocation of Resources Without Limits or ThrottlingPrimary

CWE-770 — Allocation of Resources Without Limits or Throttling: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

[Requirements] Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
[Architecture and Design] Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

Source: MITRE CWE corpus.