PT-2026-47591 · Crates.Io · Http-Types
Published
2026-03-11
·
Updated
2026-03-11
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Authorization::value uses HeaderValue::value with the claim
that the internal string is ASCII, but Authorization::new and
Authorization::set credentials accept arbitrary String credentials without
validation. As a result, safe code can construct a header value containing
non-ASCII UTF-8 while the implementation assumes ASCII.WwwAuthenticate::new and WwwAuthenticate::set realm similarly accepts arbitrary String input, so WwwAuthenticate::value can also produce a header value that violates the crate’s documented ASCII invariants.This issue has not been confirmed as Undefined Behavior, but the unsafe
justification in
Authorization::value and WwwAuthenticate::value appears incorrect and can produce values outside the expected ASCII-only constraints.The http-types crate is unmaintained and the issue is unlikely to be fixed.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Http-Types