PT-2025-28030 · Web-Push · Web-Push

Niklasf · Published 2025-02-16 · Updated 2025-07-05 · CVE-2025-53604

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: web-push crate versions prior to 0.10.3

Description: The issue allows an attacker to cause a denial of service condition through excessive memory consumption in the built-in clients of the web-push crate via a large integer in a Content-Length header.

Recommendations: For versions prior to 0.10.3, update to version 0.10.3 or later to resolve the issue. As a temporary workaround, consider restricting the size of the Content-Length header to prevent excessive memory consumption.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-130

CWE-770

Related Identifiers

CVE-2025-53604

GHSA-287X-9RFF-QVCG

GHSA-FC83-9JWQ-GC2M

RUSTSEC-2025-0015

Affected Products

Web-Push

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2025-53604 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53604 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fc83-9jwq-gc2m · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2025-0015 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-287x-9rff-qvcg · Vendor Advisory
• https://github.com/pimeys/rust-web-push/pull/68 · Note
• https://github.com/pimeys/rust-web-push/commit/8447ed86bf3f24629abd7022b94104bf3cd64453 · Note
• https://github.com/pimeys/rust-web-push · Note
• https://twitter.com/transilienceai/status/1941357030746489090 · Twitter Post
• https://crates.io/crates/web-push · Note
• https://rustsec.org/advisories/RUSTSEC-2025-0015.html · Note
• https://t.me/cvenotify/127743 · Telegram Post
• https://twitter.com/CVEnew/status/1941303086280004007 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1941356808880173097 · Twitter Post