Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
HTTP Parser Creates Uninitialized Header Values
published 4 years ago
Summary
A bug in the HTTP1 parser can cause it to create invalid header values. This can lead to incorrect parsing of HTTP requests, potentially causing issues with how your website or application handles incoming requests. To fix this, update to the latest version of the affected software.
What to do
- Update seanmonstar hyper to version 0.14.12.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| rust | seanmonstar | hyper |
< 0.14.12 Fix: upgrade to 0.14.12
|
Original advisory text
Parser creates invalid uninitialized value
Affected versions of this crate called `mem::uninitialized()` in the HTTP1 parser to create values of type `httparse::Header` (from the `httparse` crate).
This is unsound, since `Header` contains references and thus must be non-null.
The flaw was corrected by avoiding the use of `mem::uninitialized()`, using `MaybeUninit` instead.
This is unsound, since `Header` contains references and thus must be non-null.
The flaw was corrected by avoiding the use of `mem::uninitialized()`, using `MaybeUninit` instead.
Timeline
Published16 Jun 2022
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-f67m-9j94-qv9j · GHSA
Track software like this
Free during beta