GitHub Advisoryadvisory · crates.io

GHSA-x7vr-c387-8w57 Integer Overflow/Infinite Loop in the http crate

HIGH Published 2021-08-25 Modified 2023-06-13 Official page ↗
Aliases
CVE-2020-25574
Ecosystem
crates.io
Packages
http
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-190, CWE-835
Reviewed
2021-07-26

Affected packages

• crates.io http: < 0.1.20 → fixed in 0.1.20

Description

HeaderMap::reserve() used usize::next_power_of_two() to calculate the increased capacity. However, next_power_of_two() silently overflows to 0 if given a sufficiently large number in release mode. If the map was not empty when the overflow happens, the library will invoke self.grow(0) and start infinite probing. This allows an attacker who controls the argument to reserve() to cause a potential denial of service (DoS). The flaw was corrected in 0.1.20 release of http crate.

Related

Alias · CVE (1)

  • CVE-2020-25574 An issue was discovered in the http crate before 0.1.20 for Rust. vulnerability

Weakness · CWE (2)

  • CWE-190 Integer Overflow or Wraparound weakness
  • CWE-835 Loop with Unreachable Exit Condition weakness

References