PT-2026-47591 · Crates.Io · Http-Types
Publicado
2026-03-11
·
Atualizado
2026-03-11
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
Authorization::value uses HeaderValue::value with the claim
that the internal string is ASCII, but Authorization::new and
Authorization::set credentials accept arbitrary String credentials without
validation. As a result, safe code can construct a header value containing
non-ASCII UTF-8 while the implementation assumes ASCII.WwwAuthenticate::new and WwwAuthenticate::set realm similarly accepts arbitrary String input, so WwwAuthenticate::value can also produce a header value that violates the crate’s documented ASCII invariants.This issue has not been confirmed as Undefined Behavior, but the unsafe
justification in
Authorization::value and WwwAuthenticate::value appears incorrect and can produce values outside the expected ASCII-only constraints.The http-types crate is unmaintained and the issue is unlikely to be fixed.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Http-Types