-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
RustRust| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| loona-hpack | rust | <= 0.4.2 | 0.4.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the update_max_dynamic_size function in decoder.rs. The commit diff shows the vulnerable code used 'decode_integer(buf, 5).ok().unwrap()' which panics when decoding fails. The CWE-754/755 classifications confirm improper error handling. The original hpack-rs issue #11 describes the same pattern of unsafe unwrapping in size update handling. The PoC triggers this code path through Decoder::decode, making this the definitive vulnerable function.
Ongoing coverage of React2Shell