{"id":"RUSTSEC-2026-0174","aliases":[],"status":"published","title":"`Authorization::value` and `WwwAuthenticate::value` can violate ASCII invariants","description":"`Authorization::value` uses `HeaderValue::value` with the claim\nthat the internal string is ASCII, but `Authorization::new` and\n`Authorization::set_credentials` accept arbitrary `String` credentials without\nvalidation. As a result, safe code can construct a header value containing\nnon-ASCII UTF-8 while the implementation assumes ASCII.\n\n`WwwAuthenticate::new` and `WwwAuthenticate::set_realm` similarly accepts arbitrary `String` input, so `WwwAuthenticate::value` can also produce a header value that violates the crate’s documented ASCII invariants. \n\nThis issue has not been confirmed as Undefined Behavior, but the unsafe\njustification in `Authorization::value` and `WwwAuthenticate::value` appears incorrect and can produce values outside the expected ASCII-only constraints.\n\nThe http-types crate is unmaintained and the issue is unlikely to be fixed.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-03-11T12:00:00Z","modified":"2026-06-08T16:30:03Z","affected":[{"source":"osv","ecosystem":"crates.io","package":"http-types","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"}]}]}],"references":[{"url":"https://crates.io/crates/http-types","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0174.html","tags":["advisory"]},{"url":"https://github.com/http-rs/http-types/issues/534","tags":["report"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0174","title":"`Authorization::value` and `WwwAuthenticate::value` can violate ASCII invariants","description":"`Authorization::value` uses `HeaderValue::value` with the claim\nthat the internal string is ASCII, but `Authorization::new` and\n`Authorization::set_credentials` accept arbitrary `String` credentials without\nvalidation. As a result, safe code can construct a header value containing\nnon-ASCII UTF-8 while the implementation assumes ASCII.\n\n`WwwAuthenticate::new` and `WwwAuthenticate::set_realm` similarly accepts arbitrary `String` input, so `WwwAuthenticate::value` can also produce a header value that violates the crate’s documented ASCII invariants. \n\nThis issue has not been confirmed as Undefined Behavior, but the unsafe\njustification in `Authorization::value` and `WwwAuthenticate::value` appears incorrect and can produce values outside the expected ASCII-only constraints.\n\nThe http-types crate is unmaintained and the issue is unlikely to be fixed.","status":"published","published":"2026-03-11T12:00:00Z","modified":"2026-06-08T16:30:03.596256414Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}