GHSA-f67m-9j94-qv9j RUSTSEC-2022-0022

Parser creates invalid uninitialized value

High crates.io

Severity: High; The publisher's own rating, not a CVSS score
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: —; Not classified
Fix: 0.14.12; Upgrade hyper to this version or later

Description

Affected versions of this crate called mem::uninitialized() in the HTTP1 parser to create values of type httparse::Header (from the httparse crate). This is unsound, since Header contains references and thus must be non-null.

The flaw was corrected by avoiding the use of mem::uninitialized(), using MaybeUninit instead.

Affected versions

crates.io

Package	Vulnerable	Fixed in
hyper	`< 0.14.12`	`0.14.12`
hyper	`>= 0.0.0-0, < 0.14.12`	`0.14.12`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

hyper crates.io → `0.14.12`

cargo

cargo update -p hyper --precise 0.14.12

References

Packages

Timeline

May 10, 2022 Published
Sep 10, 2026 Last updated by the source

Advisory	Severity	Why it's related
GHSA-f3pg-qwvg-p99c Lenient Parsing of Content-Length Header When Prefixed with Plus Sign	Low	Also affects hyper
GHSA-5h46-h7hh-c6x9 Integer Overflow in Chunked Transfer-Encoding	Medium	Also affects hyper
GHSA-6hfq-h8hq-87mf HTTP Request Smuggling in hyper	Medium	Also affects hyper
GHSA-h3qr-rq2j-74w4 HTTP Request Smuggling in hyper	Critical	Also affects hyper
GHSA-q89x-f52w-6hj2 Headers containing newline characters can split messages in hyper	Medium	Also affects hyper
GHSA-9xjr-m6f3-v5wm HTTPS MitM vulnerability due to lack of hostname verification	Medium	Also affects hyper

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor