Vulnerability HighRUSTSEC-2023-0085 · hpack
RUSTSEC-2023-0085: HPACK decoder panics on invalid input
Short answerA security vulnerability in the hpack crate: HPACK decoder panics on invalid input. GitHub rates it High. No fixed version: replace the crate or remove the affected code path.
| Crate | hpack |
|---|---|
| Type | Vulnerability (denial-of-service) |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | High (GitHub rating) |
| Published | 2023-09-15 |
| Last changed | 2026-07-22 |
| Also known as | GHSA-w7hm-hmxv-pvhf |
What to do
- Find who pulls it in:
cargo tree -i hpack. - Avoid the affected API, or replace the crate.
Details from the advisory
Due to insufficient checking of input data, decoding certain data sequences can lead to _Decoder::decode_ panicking rather than returning an error.
Example code that triggers this vulnerability looks like this:
use hpack::Decoder;
pub fn main() {
let input = &[0x3f];
let mut decoder = Decoder::new();
let _ = decoder.decode(input);
}hpack is unmaintained. A crate with the panics fixed has been published as hpack-patched.
Also consider using loona-hpack or httlib-huffman as an alternative.
Version 0.3.1 of fluke-hpack still reproduces the panic described in this advisory.
References
- Package: crates.io/crates/hpack
- Advisory: rustsec.org/advisories/RUSTSEC-2023-0085.html
- Report: github.com/mlalic/hpack-rs/issues/11
- Web: github.com/sno2/hpack-rs-patched/commit/d669282924a95311599e9e7dd53869ee96b3a2f5
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for hpack
Up next
Same cratehpack: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?