Vulnerability GHSA-f67m-9j94-qv9j
High Risk
HIGH RISK
CVSS Score: 8.0
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
4 years ago
June 16, 2022 at 11:59 PM UTC
Parser creates invalid uninitialized value
0.0.1 - 0.12.36 and 0.13.0 - 0.14.11
0.0.1 - 0.12.36 and 0.13.0 - 0.14.11
Summary
Parser creates invalid uninitialized value
Details
Affected versions of this crate called mem::uninitialized() in the HTTP1 parser to create values of type httparse::Header (from the httparse crate). This is unsound, since Header contains references and thus must be non-null.
The flaw was corrected by avoiding the use of mem::uninitialized(), using MaybeUninit instead.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
4 years ago
Parser creates invalid uninitialized value
0.0.1 - 0.12.36 and 0.13.0 - 0.14.11 RUSTSEC-2022-0022
0.0.1 - 0.12.36 and 0.13.0 - 0.14.11 RUSTSEC-2022-0022
Medium Risk
5 years ago
HTTP Request Smuggling in hyper
0.12.0 - 0.12.35 and 0.13.0 - 0.13.9 and 0.14.0 - 0.14.2 GHSA-6hfq-h8hq-87mf
0.12.0 - 0.12.35 and 0.13.0 - 0.13.9 and 0.14.0 - 0.14.2 GHSA-6hfq-h8hq-87mf
Critical
5 years ago
HTTP Request Smuggling in hyper
0.11.0 - 0.12.33 GHSA-h3qr-rq2j-74w4
0.11.0 - 0.12.33 GHSA-h3qr-rq2j-74w4
Medium Risk
5 years ago
HTTPS MitM vulnerability due to lack of hostname verification
0.0.1 - 0.9.3 GHSA-9xjr-m6f3-v5wm
0.0.1 - 0.9.3 GHSA-9xjr-m6f3-v5wm
Medium Risk
5 years ago
Headers containing newline characters can split messages in hyper
0.0.1 - 0.9.17 and 0.10.0 - 0.10.1 GHSA-q89x-f52w-6hj2
0.0.1 - 0.9.17 and 0.10.0 - 0.10.1 GHSA-q89x-f52w-6hj2
Impacted packages
Timeline
Published
4 years ago
June 16, 2022 at 11:59 PM UTC
Fixed (0.14.12)
5 years ago
August 24, 2021 at 11:25 PM UTC
Last Modified
1 month ago
September 10, 2026 at 03:49 AM UTC