CVE-2024-51502
5.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Summary
loona is an experimental, HTTP/1.1 and HTTP/2 implementation in Rust on top of io-uring. loona-hpack suffers from the same vulnerability as the original hpack as documented in issue #11. All users who try to decode untrusted input using the Decoder are vulnerable to this exploit. This issue has been addressed in release version 0.4.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| bearcove | loona | < 0.4.3 | affected |
Weaknesses
- CWE-755: CWE-755: Improper Handling of Exceptional Conditions
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: poc
- Automatable: no
- Technical Impact: partial
References
- https://github.com/bearcove/loona/security/advisories/GHSA-7vm6-qwh5-9x44
- https://github.com/mlalic/hpack-rs/issues/11
- https://github.com/bearcove/loona/commit/9a4028ec6484f50a320281271a41a5040ddb1ba8
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.