{"id":"RUSTSEC-2023-0085","aliases":["GHSA-w7hm-hmxv-pvhf"],"title":"HPACK decoder panics on invalid input","summary":"HPACK decoder panics on invalid input","severity":"none","vendor":"hpack","product":"hpack","ecosystem":"rust","affected":["hpack >= 0.0.0-0"],"published":"2023-09-15","updated":"2026-07-22","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2023-0085","references":[{"url":"https://crates.io/crates/hpack"},{"url":"https://rustsec.org/advisories/RUSTSEC-2023-0085.html"},{"url":"https://github.com/mlalic/hpack-rs/issues/11"},{"url":"https://github.com/sno2/hpack-rs-patched/commit/d669282924a95311599e9e7dd53869ee96b3a2f5"}],"tags":["osv","rust"],"ingestedAt":"2026-07-22T19:05:46.073Z","slug":"RUSTSEC-2023-0085","body":"## Overview\n\nDue to insufficient checking of input data, decoding certain data sequences can\nlead to _Decoder::decode_ panicking rather than returning an error.\n\nExample code that triggers this vulnerability looks like this:\n\n```rust\nuse hpack::Decoder;\n\npub fn main() {\n  let input = &[0x3f];\n  let mut decoder = Decoder::new();\n  let _ = decoder.decode(input);\n}\n```\n\nhpack is unmaintained. A crate with the panics fixed has been published as\n[hpack-patched](https://crates.io/crates/hpack-patched).\n\nAlso consider using\n[loona-hpack](https://crates.io/crates/loona-hpack) or\n[httlib-huffman](https://crates.io/crates/httlib-huffman) as an alternative.\n\nVersion 0.3.1 of\n[fluke-hpack](https://crates.io/crates/fluke-hpack) still reproduces the panic\ndescribed in this advisory.\n\n## Affected packages\n\n- `hpack >= 0.0.0-0`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}