~ / search / GHSA-5rrv-m36h-qwf8

GHSA-5rrv-m36h-qwf8

Use-after-free in chttp

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-16140

Packages

EcosystemPackageAffectedFixed in
crates.io chttp >= 0.1.1, < 0.1.3 0.1.3

Details

As written in the advisory (Markdown source, shown as plain text).

The From implementation for Vec was not properly implemented, returning a vector backed by freed memory. This could lead to memory corruption or be exploited to cause undefined behavior. A fix was published in version 0.1.3.

References

External links from the advisory. They lead to third-party sites.