RUSTSEC-2026-0174 `Authorization::value` and `WwwAuthenticate::value` can violate ASCII invariants
Safe code can construct HTTP headers with non-ASCII characters, violating internal invariants and potentially causing undefined behavior in the unmaintained http-types crate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is RUSTSEC-2026-0174?
RUSTSEC-2026-0174 is a vulnerability in http-types, published on 11 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Authorization::value uses HeaderValue::value with the claim
that the internal string is ASCII, but Authorization::new and
Authorization::set_credentials accept arbitrary String credentials without
validation. As a result, safe code can construct a header value containing
non-ASCII UTF-8 while the implementation assumes ASCII.
WwwAuthenticate::new and WwwAuthenticate::set_realm similarly accepts arbitrary String input, so WwwAuthenticate::value can also produce a header value that violates the crate’s documented ASCII invariants.
This issue has not been confirmed as Undefined Behavior, but the unsafe
justification in Authorization::value and WwwAuthenticate::value appears incorrect and can produce values outside the expected ASCII-only constraints.
The http-types crate is unmaintained and the issue is unlikely to be fixed.
Which versions are affected by RUSTSEC-2026-0174?
1 open source package ship an affected version, including http-types.
| Package | Affected | Fixed in |
|---|---|---|
http-types crates.io | From 0.0.0-0 | None |
How do I fix RUSTSEC-2026-0174?
No fix has been published for RUSTSEC-2026-0174 yet. Limit exposure of the affected software until one is available.
Is RUSTSEC-2026-0174 being exploited?
There is no known exploitation of RUSTSEC-2026-0174 in the wild and no public exploit code.