RUSTSEC-2023-0085None▾ SunlitHPACK decoder panics on invalid input
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
Due to insufficient checking of input data, decoding certain data sequences can lead to Decoder::decode panicking rather than returning an error.
Example code that triggers this vulnerability looks like this:
use hpack::Decoder;
pub fn main() {
let input = &[0x3f];
let mut decoder = Decoder::new();
let _ = decoder.decode(input);
}
hpack is unmaintained. A crate with the panics fixed has been published as hpack-patched.
Also consider using loona-hpack or httlib-huffman as an alternative.
Version 0.3.1 of fluke-hpack still reproduces the panic described in this advisory.
hpack >= 0.0.0-0Refer to the advisory for the patched release.