1 line
1.8 KiB
JSON
1 line
1.8 KiB
JSON
{"schema_version":"1.7.5","id":"RUSTSEC-2023-0085","published":"2023-09-15T12:00:00Z","modified":"2026-07-22T17:45:03.860310154Z","aliases":["GHSA-w7hm-hmxv-pvhf"],"summary":"HPACK decoder panics on invalid input","details":"Due to insufficient checking of input data, decoding certain data sequences can\nlead to _Decoder::decode_ panicking rather than returning an error.\n\nExample code that triggers this vulnerability looks like this:\n\n```rust\nuse hpack::Decoder;\n\npub fn main() {\n let input = &[0x3f];\n let mut decoder = Decoder::new();\n let _ = decoder.decode(input);\n}\n```\n\nhpack is unmaintained. A crate with the panics fixed has been published as\n[hpack-patched](https://crates.io/crates/hpack-patched).\n\nAlso consider using\n[loona-hpack](https://crates.io/crates/loona-hpack) or\n[httlib-huffman](https://crates.io/crates/httlib-huffman) as an alternative.\n\nVersion 0.3.1 of\n[fluke-hpack](https://crates.io/crates/fluke-hpack) still reproduces the panic\ndescribed in this advisory.","affected":[{"package":{"name":"hpack","ecosystem":"crates.io","purl":"pkg:cargo/hpack"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["denial-of-service"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2023-0085.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hpack"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2023-0085.html"},{"type":"REPORT","url":"https://github.com/mlalic/hpack-rs/issues/11"},{"type":"WEB","url":"https://github.com/sno2/hpack-rs-patched/commit/d669282924a95311599e9e7dd53869ee96b3a2f5"}],"database_specific":{"license":"CC0-1.0"}} |