Reported

November 16, 2019

Issued

October 1, 2020 (last modified: June 13, 2023)

Package

http (crates.io)

Type

Vulnerability

Categories

• memory-corruption

Keywords

#memory-safety #double-free #unsound

Aliases

• CVE-2019-25009
• GHSA-6rhx-hqxm-8p36

CVSS Score

9.8 CRITICAL

CVSS Details

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Patched

• >=0.1.20

Affected Functions

Version

http::header::HeaderMap::drain

• <0.1.20

Description

Affected versions of this crate incorrectly used raw pointer, which introduced unsoundness in its public safe API.

Failing to drop the Drain struct causes double-free, and it is possible to violate Rust's alias rule and cause data race with Drain's Iterator implementation.

The flaw was corrected in 0.1.20 release of http crate.

Advisory available under CC0-1.0 license.