{"id":"CVE-2020-25574","aliases":["CVE-2019-25008","GHSA-x7vr-c387-8w57","GHSA-xvc9-xwgj-4cq9","RUSTSEC-2019-0033"],"url":"https://o3.security/vulnerability/CVE-2020-25574","summary":"Integer Overflow/Infinite Loop in the http crate","details":"An issue was discovered in the http crate before 0.1.20 for Rust. An integer overflow in HeaderMap::reserve() could result in denial of service (e.g., an infinite loop).","published":"2020-09-14T19:15:11.333Z","modified":"2026-07-08T17:57:00.568091Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"crates.io","name":"http","fixedVersion":"0.1.20"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2019-0033.html"},{"type":"FIX","url":"https://github.com/hyperium/http/issues/352"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T17:57:00.568091Z"}}