GHSA-7vm6-qwh5-9x44 loona-hpack Panic Vulnerability

• crates.io loona-hpack: < 0.4.3 → fixed in 0.4.3

Summary `loona-hpack` suffers from the same vulnerability as the original `hpack` as documented in https://github.com/mlalic/hpack-rs/issues/11 Details The original includes a very nice description of the problem, as well as an easy-enough fix for it. PoC The original example pretty much still applies: ```rust use loona_hpack::Decoder; pub fn main() { let input = &[0x3f]; let mut decoder = Decoder::new(); let _ = decoder.decode(input); } ``` Impact From the original: `All users who try to decode untrusted input using the Decoder are vulnerable to this exploit. A patched version of the crate is available on crates.io under the name hpack-patched. See Cargo's documentation on overriding dependencies for more information.`