https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 22:12:16 +0000 https://cve.radiocsirt.org/vuln/cve-2019-25008 CVE-2019-25008 https://cve.radiocsirt.org/vuln/cve-2019-25008 https://cve.radiocsirt.org/vuln/ghsa-x7vr-c387-8w57 <p><strong>Affected:</strong> crates.io: http</p> <p>HeaderMap::reserve() used usize::next_power_of_two() to calculate the increased capacity. However, next_power_of_two() silently overflows to 0 if given a sufficiently large number in release mode.</p> <p>If the map was not empty when the overflow happens, the library will invoke self.grow(0) and start infinite probing. This allows an attacker who controls the argument to reserve() to cause a potential denial of service (DoS).</p> <p>The flaw was corrected in 0.1.20 release of http crate.</p> <p><strong>Affected:</strong> crates.io: http</p> <p>HeaderMap::reserve() used usize::next_power_of_two() to calculate the increased capacity. However, next_power_of_two() silently overflows to 0 if given a sufficiently large number in release mode.</p> <p>If the map was not empty when the overflow happens, the library will invoke self.grow(0) and start infinite probing. This allows an attacker who controls the argument to reserve() to cause a potential denial of service (DoS).</p> <p>The flaw was corrected in 0.1.20 release of http crate.</p> https://cve.radiocsirt.org/vuln/ghsa-x7vr-c387-8w57