CVE-2020-25574: Integer Overflow
Published Sep 14, 2020
·Updated
An issue was discovered in the http crate before 0.1.20 for Rust. An integer overflow in HeaderMap::reserve() could result in denial of service (e.g., an infinite loop).
Affected Software
1 affected component
hyper Http<0.1.20
Remediation
Patch Available
Event History
Sep 14, 2020
CVE Published
via MITRE·06:16 PM
Data Sourced
via MITRE·06:16 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2020-25574?
The severity of CVE-2020-25574 is high.
2
What is the affected software for CVE-2020-25574?
The affected software for CVE-2020-25574 is the Hyper Http crate before version 0.1.20.
3
How can CVE-2020-25574 be exploited?
CVE-2020-25574 can be exploited by triggering an integer overflow in HeaderMap::reserve() which could result in denial of service.
4
Is there a fix available for CVE-2020-25574?
Yes, upgrading to version 0.1.20 of the Hyper Http crate resolves CVE-2020-25574.
5
Where can I find more information about CVE-2020-25574?
You can find more information about CVE-2020-25574 at the following references: [GitHub](https://github.com/hyperium/http/issues/352) and [RustSec Advisory](https://rustsec.org/advisories/RUSTSEC-2019-0033.html).