1 line
1.8 KiB
JSON
1 line
1.8 KiB
JSON
{"schema_version":"1.7.5","id":"RUSTSEC-2026-0174","published":"2026-03-11T12:00:00Z","modified":"2026-06-08T16:30:03.596256414Z","summary":"`Authorization::value` and `WwwAuthenticate::value` can violate ASCII invariants","details":"`Authorization::value` uses `HeaderValue::value` with the claim\nthat the internal string is ASCII, but `Authorization::new` and\n`Authorization::set_credentials` accept arbitrary `String` credentials without\nvalidation. As a result, safe code can construct a header value containing\nnon-ASCII UTF-8 while the implementation assumes ASCII.\n\n`WwwAuthenticate::new` and `WwwAuthenticate::set_realm` similarly accepts arbitrary `String` input, so `WwwAuthenticate::value` can also produce a header value that violates the crate’s documented ASCII invariants. \n\nThis issue has not been confirmed as Undefined Behavior, but the unsafe\njustification in `Authorization::value` and `WwwAuthenticate::value` appears incorrect and can produce values outside the expected ASCII-only constraints.\n\nThe http-types crate is unmaintained and the issue is unlikely to be fixed.","affected":[{"package":{"name":"http-types","ecosystem":"crates.io","purl":"pkg:cargo/http-types"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":[],"cvss":null,"informational":"notice","source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0174.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/http-types"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0174.html"},{"type":"REPORT","url":"https://github.com/http-rs/http-types/issues/534"}],"database_specific":{"license":"CC0-1.0"}} |