---
id: RUSTSEC-2023-0085
aliases:
  - GHSA-w7hm-hmxv-pvhf
title: HPACK decoder panics on invalid input
summary: HPACK decoder panics on invalid input
severity: none
vendor: hpack
product: hpack
ecosystem: rust
affected:
  - hpack >= 0.0.0-0
published: '2023-09-15'
updated: '2026-07-22'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2023-0085'
references:
  - url: 'https://crates.io/crates/hpack'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2023-0085.html'
  - url: 'https://github.com/mlalic/hpack-rs/issues/11'
  - url: >-
      https://github.com/sno2/hpack-rs-patched/commit/d669282924a95311599e9e7dd53869ee96b3a2f5
tags:
  - osv
  - rust
ingestedAt: '2026-07-22T19:05:46.073Z'
---

## Overview

Due to insufficient checking of input data, decoding certain data sequences can
lead to _Decoder::decode_ panicking rather than returning an error.

Example code that triggers this vulnerability looks like this:

```rust
use hpack::Decoder;

pub fn main() {
  let input = &[0x3f];
  let mut decoder = Decoder::new();
  let _ = decoder.decode(input);
}
```

hpack is unmaintained. A crate with the panics fixed has been published as
[hpack-patched](https://crates.io/crates/hpack-patched).

Also consider using
[loona-hpack](https://crates.io/crates/loona-hpack) or
[httlib-huffman](https://crates.io/crates/httlib-huffman) as an alternative.

Version 0.3.1 of
[fluke-hpack](https://crates.io/crates/fluke-hpack) still reproduces the panic
described in this advisory.

## Affected packages

- `hpack >= 0.0.0-0`

## Remediation

Refer to the advisory for the patched release.