{"id":"CVE-2024-51502","aliases":["GHSA-7vm6-qwh5-9x44"],"url":"https://o3.security/vulnerability/CVE-2024-51502","summary":"Panic Vulnerability in loona-hpack","details":"### Summary\n`loona-hpack` suffers from the same vulnerability as the original `hpack` as documented in https://github.com/mlalic/hpack-rs/issues/11 \n\n### Details\nThe original includes a very nice description of the problem, as well as an easy-enough fix for it.\n\n### PoC\nThe original example pretty much still applies:\n```rust\nuse loona_hpack::Decoder;\n\npub fn main() {\n    let input = &[0x3f];\n    let mut decoder = Decoder::new();\n    let _ = decoder.decode(input);\n}\n```\n\n### Impact\nFrom the original:\n`All users who try to decode untrusted input using the Decoder are vulnerable to this exploit. A patched version of the crate is available on [crates.io](https://crates.io/crates/hpack-patched) under the name hpack-patched. See [Cargo's documentation on overriding dependencies](https://doc.rust-lang.org/cargo/reference/overriding-dependencies.html) for more information.`\n","published":"2024-11-04T22:42:29.920Z","modified":"2026-08-12T03:51:27.589348855Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"loona-hpack","fixedVersion":"0.4.3"}],"fix":{"url":"https://github.com/bearcove/loona/commit/9a4028ec6484f50a320281271a41a5040ddb1ba8","label":"bearcove/loona@9a4028e"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51502.json"},{"type":"ADVISORY","url":"https://github.com/bearcove/loona/security/advisories/GHSA-7vm6-qwh5-9x44"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-51502"},{"type":"REPORT","url":"https://github.com/mlalic/hpack-rs/issues/11"},{"type":"FIX","url":"https://github.com/bearcove/loona/commit/9a4028ec6484f50a320281271a41a5040ddb1ba8"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-w7hm-hmxv-pvhf"},{"type":"PACKAGE","url":"https://github.com/bearcove/loona"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:27.589348855Z"}}