Most recent entries from all

cnvd-2021-30441

EUVD-2026-60360

fkie_cve-2019-25009

An issue was discovered in the http crate before 0.1.20 for Rust. The HeaderMap::Drain API can use a raw pointer, defeating soundness.

GHSA-6rhx-hqxm-8p36 — Double free in http

Affected: crates.io: http

An issue was discovered in the http crate before 0.1.20 for Rust. The HeaderMap::Drain API can use a raw pointer, defeating soundness.

gsd-2019-25009

RUSTSEC-2019-0034 — HeaderMap::Drain API is unsound

Affected: crates.io: http

Affected versions of this crate incorrectly used raw pointer, which introduced unsoundness in its public safe API.

[Failing to drop the Drain struct causes double-free](https://github.com/hyperium/http/issues/354), and [it is possible to violate Rust's alias rule and cause data race with Drain's Iterator implementation](https://github.com/hyperium/http/issues/355).

The flaw was corrected in 0.1.20 release of `http` crate.

UBUNTU-CVE-2019-25009

Affected: Ubuntu:20.04:LTS: rust-http, Ubuntu:24.04:LTS: rust-http, Ubuntu:25.10: rust-http, Ubuntu:26.04:LTS: rust-http

An issue was discovered in the http crate before 0.1.20 for Rust. The HeaderMap::Drain API can use a raw pointer, defeating soundness.