Vulnerability · Published Nov 4, 2024 · Assigned by GitHub_M

CVE-2024-51502Panic Vulnerability in loona-hpack

Medium 5.1

In plain English

A medium-severity security flaw in loona from bearcove. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.5%top 58.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

loona is an experimental, HTTP/1.1 and HTTP/2 implementation in Rust on top of io-uring. `loona-hpack` suffers from the same vulnerability as the original `hpack` as documented in issue #11. All users who try to decode untrusted input using the Decoder are vulnerable to this exploit. This issue has been addressed in release version 0.4.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
bearcove	loona	< 0.4.3

Weakness: CWE-755 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

https://github.com/bearcove/loona/security/advisories/GHSA-7vm6-qwh5-9x44 x_refsource_CONFIRM
https://github.com/mlalic/hpack-rs/issues/11 x_refsource_MISC
https://github.com/bearcove/loona/commit/9a4028ec6484f50a320281271a41a5040ddb1ba8 x_refsource_MISC