CVE-2017-18589
Improper Input Validation in cookie
An issue was discovered in the cookie crate before 0.7.6 for Rust. Large integers in the Max-Age of a cookie cause a panic.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the cookie crate before 0.7.6 for Rust. Large integers in the Max-Age of a cookie cause a panic.
- Record
CVE-2017-18589- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in the cookie crate before 0.7.6 for Rust. Large integers in the Max-Age of a cookie cause a panic.
- Record
CVE-2017-18589- Updated
- 2026-11-02
EUVDEUVD-2021-1897 No score
An issue was discovered in the cookie crate before 0.7.6 for Rust. Large integers in the Max-Age of a cookie cause a panic.
- Record
EUVD-2021-1897- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vjrq-cg9x-rfjp
Improper Input Validation in cookie
Affected versions of this crate use the time crate and the method Duration::seconds to parse the Max-Age duration cookie setting. This method will panic if the value is greater than 2^64/1000 and less than or equal to 2^64, which can result in denial of service for a client or server.
This flaw was corrected by explicitly checking for the Max-Age being in this integer range and clamping the value to the maximum duration value.
- Record
GHSA-vjrq-cg9x-rfjp- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-vjrq-cg9x-rfjp
Improper Input Validation in cookie
Affected versions of this crate use the time crate and the method Duration::seconds to parse the Max-Age duration cookie setting. This method will panic if the value is greater than 2^64/1000 and less than or equal to 2^64, which can result in denial of service for a client or server.
This flaw was corrected by explicitly checking for the Max-Age being in this integer range and clamping the value to the maximum duration value.
- Record
GHSA-vjrq-cg9x-rfjp- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVRUSTSEC-2017-0005
Large cookie Max-Age values can cause a denial of service
Affected versions of this crate use the time crate and the method
Duration::seconds to parse the Max-Age duration cookie setting. This method
will panic if the value is greater than 2^64/1000 and less than or equal to
2^64, which can result in denial of service for a client or server.
This flaw was corrected by explicitly checking for the Max-Age being in this
integer range and clamping the value to the maximum duration value.
- Record
RUSTSEC-2017-0005- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-18589 is a high vulnerability (CVSS 7.5) in Cookie Project Cookie, published May 6, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.51%, the 74th percentile. Fixed in cookie 0.7.6.
References
rustsec.org/advisories/RUSTSEC-2017-0005.html
nvd.nist.gov/vuln/detail/CVE-2017-18589
github.com/SergioBenitez/cookie-rs/pull/86
crates.io/crates/cookie