Medium severity4.0GHSA Advisory· Published Jul 5, 2025· Updated Apr 15, 2026
CVE-2025-53604
CVE-2025-53604
Description
The web-push crate before 0.10.3 for Rust allows a denial of service (memory consumption) in the built-in clients via a large integer in a Content-Length header.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
web-pushcrates.io | < 0.10.4 | 0.10.4 |
Affected products
2- Range: <= 0.10.2
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-287x-9rff-qvcgghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-53604ghsaADVISORY
- crates.io/crates/web-pushnvdWEB
- github.com/pimeys/rust-web-push/commit/8447ed86bf3f24629abd7022b94104bf3cd64453ghsaWEB
- github.com/pimeys/rust-web-push/pull/68nvdWEB
- rustsec.org/advisories/RUSTSEC-2025-0015.htmlnvdWEB
News mentions
0No linked articles in our index yet.