GHSA-w7hm-hmxv-pvhf HPACK decoder panics on invalid input

Not scored Published 15 Sep 2023

An attacker can cause a denial of service by sending malformed HPACK data that triggers a panic in the decoder.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is GHSA-w7hm-hmxv-pvhf?

GHSA-w7hm-hmxv-pvhf is a denial of service vulnerability in hpack, published on 15 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Due to insufficient checking of input data, decoding certain data sequences can lead to Decoder::decode panicking rather than returning an error.

Example code that triggers this vulnerability looks like this:

use hpack::Decoder;

pub fn main() {
  let input = &amp;[0x3f];
  let mut decoder = Decoder::new();
  let _ = decoder.decode(input);
}

hpack is unmaintained. A crate with the panics fixed has been published as hpack-patched.

Also consider using loona-hpack or httlib-huffman as an alternative.

Version 0.3.1 of fluke-hpack still reproduces the panic described in this advisory.

Which versions are affected by GHSA-w7hm-hmxv-pvhf?

3 open source packages ship an affected version, including hpack.

Package	Affected	Fixed in
`hpack` crates.io	All versions to `0.3.0`	None
`hpack` crates.io	All versions to `0.3.0`	None
`hpack` crates.io	From `0.0.0-0`	None

How do I fix GHSA-w7hm-hmxv-pvhf?

No fix has been published for GHSA-w7hm-hmxv-pvhf yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is GHSA-w7hm-hmxv-pvhf being exploited?

There is no known exploitation of GHSA-w7hm-hmxv-pvhf in the wild and no public exploit code.

Sources

Also known as RUSTSEC-2023-0085.