Reported

May 10, 2022

Issued

May 10, 2022 (last modified: June 13, 2023)

Package

hyper (crates.io)

Type

INFO Unsound

Aliases

• GHSA-f67m-9j94-qv9j

References

• https://github.com/hyperium/hyper/pull/2545

Patched

• >=0.14.12

Description

Affected versions of this crate called mem::uninitialized() in the HTTP1 parser to create values of type httparse::Header (from the httparse crate). This is unsound, since Header contains references and thus must be non-null.

The flaw was corrected by avoiding the use of mem::uninitialized(), using MaybeUninit instead.

Advisory available under CC0-1.0 license.