GHSA-w7hm-hmxv-pvhf: 
Rust vulnerability analysis and mitigation

A high-severity vulnerability (GHSA-w7hm-hmxv-pvhf) was discovered in the HPACK Rust crate, affecting versions 0.3.0 and earlier. The vulnerability, disclosed on April 5, 2024, involves insufficient checking of input data in the HPACK decoder, which can lead to panics when processing certain invalid inputs. The issue specifically affects the Decoder::decode functionality in the unmaintained hpack crate (GitHub Advisory).

The vulnerability stems from insufficient validation of buffer length when parsing integers in the update_max_dynamic_size function after encountering a SizeUpdate field. The issue has been assigned a CVSS score of 7.5 (High), with attack vector being Network, attack complexity Low, and no privileges or user interaction required. The vulnerability is tracked under CWE-754 and can be triggered with minimal input data such as [0x3f] (GitHub Advisory, GitHub Issue).

When exploited, this vulnerability leads to a denial of service condition through application panic. The CVSS metrics indicate high availability impact while maintaining unchanged scope, with no direct impact on confidentiality or integrity (GitHub Advisory).

The vulnerability is easily exploitable with minimal code, requiring no special privileges or user interaction. A proof of concept exists that demonstrates the issue using just a single byte of input data (GitHub Issue, RustSec Advisory).

Since the original hpack crate is unmaintained, users are advised to switch to alternative implementations. A patched version has been published as hpack-patched, and alternatives such as fluke-hpack or httlib-huffman are recommended. A fix has been implemented in the patched version that properly handles the integer decoding in the update_max_dynamic_size function (GitHub Advisory, Patch Commit).