Miggo Logo
Miggo Vulnerability Database
→
CVE-2019-25008

CVE-2019-25008: Duplicate Advisory: Integer Overflow in HeaderMap::reserve() can cause Denial of Service

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2019-25008
GHSA ID
GHSA-xvc9-xwgj-4cq9
EPSS Score
-
CWE
CWE-190
Published
6/16/2022
Updated
2/21/2024
KEV Status
No
Technology
TechnologyRust

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
httprust< 0.1.200.1.20

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability description explicitly identifies HeaderMap::reserve() as the source of the integer overflow. The GitHub issue #352 shows the vulnerable code pattern in map.rs where next_power_of_two() is used without overflow protection. Multiple sources (CVE, GHSA, RustSec advisory) consistently point to this function as the root cause. The combination of unchecked arithmetic and subsequent grow(0) call creates the DoS condition.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### *upli**t* **visory T*is **visory **s ***n wit**r*wn ****us* it is * *upli**t* o* **S*-x*vr-****-*w**. T*is link is m*int*in** to pr*s*rv* *xt*rn*l r***r*n**s. ### Ori*in*l **s*ription *****rM*p::r*s*rv*() us** usiz*::n*xt_pow*r_o*_two() to **l*

Reasoning

T** vuln*r**ility **s*ription *xpli*itly i**nti*i*s *****rM*p::r*s*rv*() *s t** sour** o* t** int***r ov*r*low. T** *it*u* issu* #*** s*ows t** vuln*r**l* *o** p*tt*rn in m*p.rs w**r* n*xt_pow*r_o*_two() is us** wit*out ov*r*low prot**tion. Multipl*