{"id":"GHSA-w7hm-hmxv-pvhf","summary":"HPACK decoder panics on invalid input","details":"Due to insufficient checking of input data, decoding certain data sequences can lead to _Decoder::decode_ panicking rather than returning an error.\n\nExample code that triggers this vulnerability looks like this:\n\n```rust\nuse hpack::Decoder;\n\npub fn main() {\n  let input = &[0x3f];\n  let mut decoder = Decoder::new();\n  let _ = decoder.decode(input);\n}\n```\n\nhpack is unmaintained. A crate with the panics fixed has been published as [hpack-patched](https://crates.io/crates/hpack-patched).\n\nAlso consider using [fluke-hpack](https://crates.io/crates/fluke-hpack) or [httlib-huffman](https://crates.io/crates/httlib-huffman) as an alternative.","aliases":["RUSTSEC-2023-0085"],"modified":"2024-04-11T16:41:43.815805Z","published":"2024-04-05T15:06:27Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2024-04-05T15:06:27Z","nvd_published_at":null,"cwe_ids":["CWE-754"]},"references":[{"type":"WEB","url":"https://github.com/mlalic/hpack-rs/issues/11"},{"type":"WEB","url":"https://github.com/sno2/hpack-rs-patched/commit/d669282924a95311599e9e7dd53869ee96b3a2f5"},{"type":"PACKAGE","url":"https://github.com/mlalic/hpack-rs"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2023-0085.html"}],"affected":[{"package":{"name":"hpack","ecosystem":"crates.io","purl":"pkg:cargo/hpack"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"0.3.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-w7hm-hmxv-pvhf/GHSA-w7hm-hmxv-pvhf.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}