cve.bz

CVE-2025-53604

4.0 mediumEPSS 0.4%

Medium (4.0). EPSS 0.4% chance of exploitation in the next 30 days. Fixed in web-push 0.10.3, 0.10.4.

The web-push crate before 0.10.3 for Rust allows a denial of service (memory consumption) in the built-in clients via a large integer in a Content-Length header.

Severity

CVSS 3.1

4.0 medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L
EPSS
0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-31)
CWE
CWE-130
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-287x-9rff-qvcgcrates.ioweb-push<0.10.40.10.4
GHSA-fc83-9jwq-gc2mcrates.ioweb-push<0.10.40.10.4
RUSTSEC-2025-0015crates.ioweb-push>=0.0.0-0 <0.10.30.10.3

References

Check your stackJSON