RUSTSEC-2026-0174
`Authorization::value` and `WwwAuthenticate::value` can violate ASCII invariants
Authorization::value uses HeaderValue::value with the claim
that the internal string is ASCII, but Authorization::new and
Authorization::set_credentials accept arbitrary String credentials without
validation. As a result, safe code can construct a header value containing
non-ASCII UTF-8 while the implementation assumes ASCII.
WwwAuthenticate::new and WwwAuthenticate::set_realm similarly accepts arbitrary String input, so WwwAuthenticate::value can also produce a header value that violates the crate’s documented ASCII invariants.
This issue has not been confirmed as Undefined Behavior, but the unsafe
justification in Authorization::value and WwwAuthenticate::value appears incorrect and can produce values outside the expected ASCII-only constraints.
The http-types crate is unmaintained and the issue is unlikely to be fixed.
What each source reports
OSV No score
`Authorization::value` and `WwwAuthenticate::value` can violate ASCII invariants
Authorization::value uses HeaderValue::value with the claim
that the internal string is ASCII, but Authorization::new and
Authorization::set_credentials accept arbitrary String credentials without
validation. As a result, safe code can construct a header value containing
non-ASCII UTF-8 while the implementation assumes ASCII.
WwwAuthenticate::new and WwwAuthenticate::set_realm similarly accepts arbitrary String input, so WwwAuthenticate::value can also produce a header value that violates the crate’s documented ASCII invariants.
This issue has not been confirmed as Undefined Behavior, but the unsafe
justification in Authorization::value and WwwAuthenticate::value appears incorrect and can produce values outside the expected ASCII-only constraints.
The http-types crate is unmaintained and the issue is unlikely to be fixed.
- Record
RUSTSEC-2026-0174- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
http-typescrates.io |
0.0.0-0 and later | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0174 is a vulnerability with no CVSS score yet in http-types, published March 11, 2026. No source lists public exploit code. No source names a fixed version.