critical9.8
CVE-2019-16140
Use-after-free in chttp
Impact
The From implementation for Vec was not properly implemented, returning a vector backed by freed memory. This could lead to memory corruption or be exploited to cause undefined behavior. A fix was published in version 0.1.3.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | chttp | >= 0.1.1, < 0.1.3 | 0.1.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Isahc Project | Isahc | Version 0.1.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/sagebind/isahc/issues/2
- https://rustsec.org/advisories/RUSTSEC-2019-0016.html
- https://github.com/advisories/GHSA-5rrv-m36h-qwf8
- https://nvd.nist.gov/vuln/detail/CVE-2019-16140
- https://github.com/sagebind/isahc/commit/9e9f1fb44114078c000c78c72e691eeb9e7ac260