debian/rust-http vulnerabilities

Latest debian/rust-http CVEs

Newest publication first

1. CVE-2019-25009 Double free in http

   Published 2020-12-31

   Critical·CVSS 9.8 EPSS 1.8%

   An issue was discovered in the http crate before 0.1.20 for Rust. The HeaderMap::Drain API can use a raw pointer, defeating soundness.

2. CVE-2020-25574 Integer Overflow/Infinite Loop in the http crate

   Published 2020-09-14

   High·CVSS 7.5

   An issue was discovered in the http crate before 0.1.20 for Rust. An integer overflow in HeaderMap::reserve() could result in denial of service (e.g., an infinite loop).

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.