GHSA-f67m-9j94-qv9j: Parser creates invalid uninitialized value
N/A
CVSS Score
Basic Information
CVE ID
-
GHSA ID
EPSS Score
-
CWE
-
Published
6/16/2022
Updated
1/12/2023
KEV Status
No
Technology
Rust
Technical Details
CVSS Vector
-
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| hyper | rust | < 0.14.12 | 0.14.12 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability stems from using mem::uninitialized() with httparse::Header in HTTP1 parsing logic. The pull request #2545 specifically shows changes in role.rs where Server::parse and Client::parse methods were modified to replace mem::uninitialized() with MaybeUninit. These functions handle header parsing and were directly mentioned in commit messages ('Server::parse - use MaybeUninit' and 'Client::parse - use MaybeUninit'). The HTTP1 parser is explicitly called out in the advisory as the affected component, and httparse::Header's reference-containing nature makes uninitialized memory particularly dangerous here.