PT-2019-16426 · Rust · Http Crate

Published 2019-11-16 · Updated 2025-09-29 · CVE-2019-25009

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions http crate versions prior to 0.1.20

Description An issue was discovered in the http crate for Rust, where the HeaderMap::Drain API can use a raw pointer, defeating soundness. This introduced unsoundness in its public safe API, potentially causing double-free issues if the Drain struct is not properly dropped, and violating Rust's alias rule, which can lead to data races with Drain's Iterator implementation.

Recommendations For versions prior to 0.1.20, update to version 0.1.20 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the HeaderMap::Drain API until the update is applied.

Fix

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

CVE-2019-25009

GHSA-6RHX-HQXM-8P36

RUSTSEC-2019-0034

Affected Products

Http Crate

References · 13

• https://osv.dev/vulnerability/GHSA-6rhx-hqxm-8p36 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-25009 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-25009 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2019-0034 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-25009 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-25009 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-25009 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-25009 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-25009 · Vendor Advisory
• https://t.me/cvenotify/8002 · Telegram Post
• https://t.me/cvenotify/8219 · Telegram Post
• https://crates.io/crates/http · Note
• https://rustsec.org/advisories/RUSTSEC-2019-0034.html · Note