{"id":"GHSA-w7hm-hmxv-pvhf","aliases":["RUSTSEC-2023-0085"],"status":"published","title":"HPACK decoder panics on invalid input","description":"Due to insufficient checking of input data, decoding certain data sequences can lead to _Decoder::decode_ panicking rather than returning an error.\n\nExample code that triggers this vulnerability looks like this:\n\n```rust\nuse hpack::Decoder;\n\npub fn main() {\n  let input = \u0026[0x3f];\n  let mut decoder = Decoder::new();\n  let _ = decoder.decode(input);\n}\n```\n\nhpack is unmaintained. A crate with the panics fixed has been published as [hpack-patched](https://crates.io/crates/hpack-patched).\n\nAlso consider using [fluke-hpack](https://crates.io/crates/fluke-hpack) or [httlib-huffman](https://crates.io/crates/httlib-huffman) as an alternative.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-754"],"published":"2023-09-15T12:00:00Z","modified":"2026-07-22T17:45:03Z","affected":[{"source":"ghsa","ecosystem":"crates.io","package":"hpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.3.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"hpack","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"0.3.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"hpack","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"}]}]}],"references":[{"url":"https://github.com/mlalic/hpack-rs/issues/11","tags":["web","report"]},{"url":"https://github.com/sno2/hpack-rs-patched/commit/d669282924a95311599e9e7dd53869ee96b3a2f5","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2023-0085.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-w7hm-hmxv-pvhf"},{"url":"https://github.com/mlalic/hpack-rs","tags":["package"]},{"url":"https://crates.io/crates/hpack","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-w7hm-hmxv-pvhf","title":"HPACK decoder panics on invalid input","description":"Due to insufficient checking of input data, decoding certain data sequences can lead to _Decoder::decode_ panicking rather than returning an error.\n\nExample code that triggers this vulnerability looks like this:\n\n```rust\nuse hpack::Decoder;\n\npub fn main() {\n  let input = \u0026[0x3f];\n  let mut decoder = Decoder::new();\n  let _ = decoder.decode(input);\n}\n```\n\nhpack is unmaintained. A crate with the panics fixed has been published as [hpack-patched](https://crates.io/crates/hpack-patched).\n\nAlso consider using [fluke-hpack](https://crates.io/crates/fluke-hpack) or [httlib-huffman](https://crates.io/crates/httlib-huffman) as an alternative.","status":"published","published":"2024-04-05T15:06:27Z","modified":"2024-04-05T15:06:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T14:37:42.744468Z"}],"osv":[{"id":"GHSA-w7hm-hmxv-pvhf","title":"HPACK decoder panics on invalid input","description":"Due to insufficient checking of input data, decoding certain data sequences can lead to _Decoder::decode_ panicking rather than returning an error.\n\nExample code that triggers this vulnerability looks like this:\n\n```rust\nuse hpack::Decoder;\n\npub fn main() {\n  let input = \u0026[0x3f];\n  let mut decoder = Decoder::new();\n  let _ = decoder.decode(input);\n}\n```\n\nhpack is unmaintained. A crate with the panics fixed has been published as [hpack-patched](https://crates.io/crates/hpack-patched).\n\nAlso consider using [fluke-hpack](https://crates.io/crates/fluke-hpack) or [httlib-huffman](https://crates.io/crates/httlib-huffman) as an alternative.","status":"published","published":"2024-04-05T15:06:27Z","modified":"2024-04-11T16:41:43.815805Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T15:46:58.401149Z"},{"id":"RUSTSEC-2023-0085","title":"HPACK decoder panics on invalid input","description":"Due to insufficient checking of input data, decoding certain data sequences can\nlead to _Decoder::decode_ panicking rather than returning an error.\n\nExample code that triggers this vulnerability looks like this:\n\n```rust\nuse hpack::Decoder;\n\npub fn main() {\n  let input = \u0026[0x3f];\n  let mut decoder = Decoder::new();\n  let _ = decoder.decode(input);\n}\n```\n\nhpack is unmaintained. A crate with the panics fixed has been published as\n[hpack-patched](https://crates.io/crates/hpack-patched).\n\nAlso consider using\n[loona-hpack](https://crates.io/crates/loona-hpack) or\n[httlib-huffman](https://crates.io/crates/httlib-huffman) as an alternative.\n\nVersion 0.3.1 of\n[fluke-hpack](https://crates.io/crates/fluke-hpack) still reproduces the panic\ndescribed in this advisory.","status":"published","published":"2023-09-15T12:00:00Z","modified":"2026-07-22T17:45:03.860310154Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}