CVE-2024-51502
Panic Vulnerability in loona-hpack
- State
- Published
- Severity
- 5.1 Medium
- Published
- Nov 4, 2024
- Updated
- Nov 21, 2024
- Reserved
- Oct 28, 2024
Description
loona is an experimental, HTTP/1.1 and HTTP/2 implementation in Rust on top of io-uring. `loona-hpack` suffers from the same vulnerability as the original `hpack` as documented in issue #11. All users who try to decode untrusted input using the Decoder are vulnerable to this exploit. This issue has been addressed in release version 0.4.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N | GitHub_M |
Weaknesses
- CWE-755 Improper Handling of Exceptional Conditions
Affected Products
| Product | Versions |
|---|---|
loonabearcove |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.