crates.io/web-push CVE-2025-53604: medium 4, EPSS 0.41%

Rust Web Push is vulnerable to a DoS attack via a large integer in a Content-Length header

Action: Upgrade web-push to 0.10.4 or later.

cargo update -p web-push --precise 0.10.4

Affected

Fixed versions

Sources

• osv: GHSA-287x-9rff-qvcg
• https://nvd.nist.gov/vuln/detail/CVE-2025-53604
• https://github.com/pimeys/rust-web-push/pull/68
• https://github.com/pimeys/rust-web-push/commit/8447ed86bf3f24629abd7022b94104bf3cd64453
• https://crates.io/crates/web-push
• https://github.com/pimeys/rust-web-push
• https://rustsec.org/advisories/RUSTSEC-2025-0015.html

CVE-2025-53604 · published 2025-07-05T03:30:23Z · modified 2025-10-28T06:29:10.187331Z · JSON