RUSTSEC-2023-0085
HPACK decoder panics on invalid input
Details
Due to insufficient checking of input data, decoding certain data sequences can lead to _Decoder::decode_ panicking rather than returning an error.
Example code that triggers this vulnerability looks like this:
```rust use hpack::Decoder;
pub fn main() { let input = &[0x3f]; let mut decoder = Decoder::new(); let _ = decoder.decode(input); } ```
hpack is unmaintained. A crate with the panics fixed has been published as [hpack-patched](https://crates.io/crates/hpack-patched).
Also consider using [loona-hpack](https://crates.io/crates/loona-hpack) or [httlib-huffman](https://crates.io/crates/httlib-huffman) as an alternative.
Version 0.3.1 of [fluke-hpack](https://crates.io/crates/fluke-hpack) still reproduces the panic described in this advisory.
Are you affected?
Enter the version of the package you're using.
Affected packages
0.0.0-0 No fixed version published yet for hpack. Pin to a known-safe version or switch to an alternative.