CVE-2025-53604: Rust web-push Crate DoS Vulnerability

CVE-2025-53604 Overview

CVE-2025-53604 is a denial of service vulnerability in the web-push crate for Rust before version 0.10.3. The built-in HTTP clients allocate memory based on the Content-Length header value without validating its size. An attacker who controls or influences a push service response can supply a large integer in the Content-Length header, causing the client to consume excessive memory. The issue is tracked as RUSTSEC-2025-0015 and is classified under [CWE-130] (Improper Handling of Length Parameter Inconsistency).

Critical Impact
Applications using the vulnerable web-push crate can be forced into memory exhaustion when processing crafted HTTP responses, leading to process crash or host instability.

Affected Products

web-push crate for Rust versions prior to 0.10.3
Rust applications using the built-in HTTP clients in rust-web-push
Downstream services sending Web Push notifications via this crate

Discovery Timeline

2025-07-05 - CVE-2025-53604 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53604

Vulnerability Analysis

The web-push crate provides HTTP clients for delivering Web Push notifications to browsers and push services. When the built-in clients process an HTTP response, they read the Content-Length header and pre-allocate a buffer sized to that value. The code path does not enforce an upper bound on the header value before performing allocation.

An attacker positioned to return responses to the client, such as a malicious or compromised push endpoint, can set Content-Length to a very large integer. The client then attempts to allocate a buffer of that size, exhausting available memory. This aborts the process or degrades the host until resources are reclaimed.

The vulnerability sits in the input validation layer of the HTTP response parser rather than in the cryptographic or protocol logic of Web Push itself. Attack complexity is elevated because the attacker must control or interpose on the push service endpoint the client connects to.

Root Cause

The root cause is improper handling of a length parameter [CWE-130]. The client trusted the Content-Length value received from the remote peer and used it directly to size an in-memory buffer. No cap, streaming read, or sanity check was applied before allocation. The fix in 0.10.3 constrains the accepted length and rejects responses that exceed expected body sizes for push service replies.

Attack Vector

Exploitation requires the vulnerable client to issue a Web Push request to an attacker-influenced endpoint. This can occur through DNS manipulation, TLS interception on misconfigured deployments, or a compromised push relay. The attacker responds with a valid HTTP header block containing an oversized Content-Length. No authentication or user interaction is required on the target client. The result is memory exhaustion in the process running the crate. See the RustSec advisory and GitHub Pull Request #68 for the patch details.

Detection Methods for CVE-2025-53604

Indicators of Compromise

Rust processes linked against web-push versions earlier than 0.10.3 showing sudden resident set size growth
Application crashes with allocation failure or out-of-memory errors during Web Push delivery
HTTP responses from push endpoints containing unusually large Content-Length values

Detection Strategies

Inventory Rust binaries and Cargo.lock files to identify use of web-push at versions below 0.10.3
Inspect outbound HTTP traffic to push service endpoints for response headers advertising body sizes inconsistent with normal Web Push responses
Correlate process termination events with recent outbound connections to push endpoints to identify triggered exhaustion

Monitoring Recommendations

Alert on memory allocation spikes in services that dispatch Web Push notifications
Log and review HTTP response metadata from third-party push services, including Content-Length distributions
Enforce dependency scanning in CI pipelines to flag advisories from the RustSec database

How to Mitigate CVE-2025-53604

Immediate Actions Required

Upgrade the web-push crate to version 0.10.3 or later in all Rust projects
Run cargo audit against production dependency manifests to confirm no vulnerable versions remain
Restrict outbound Web Push traffic to trusted push service endpoints only

Patch Information

The maintainers released web-push0.10.3 addressing the issue. The corresponding change is described in GitHub Pull Request #68 and cataloged in RUSTSEC-2025-0015. The updated version is available on crates.io. Update Cargo.toml to require web-push = "0.10.3" or newer and rebuild affected binaries.

Workarounds

Place a reverse proxy or egress filter between the application and push endpoints that strips or caps Content-Length on inbound responses
Run affected services with hard memory limits via cgroups, systemd, or container runtimes to contain exhaustion attempts
Pin outbound TLS to known push provider certificates to reduce the risk of a rogue endpoint injecting malicious responses

bash

# Configuration example: update Cargo.toml and refresh the lockfile
# Cargo.toml
# [dependencies]
# web-push = "0.10.3"

cargo update -p web-push --precise 0.10.3
cargo audit