CVE-2024-51502 Vulnerability Details

  /     /     /  

CVE-2024-51502 Metadata Quick Info

CVE Published: 04/11/2024 | CVE Updated: 21/11/2024 | CVE Year: 2024
Source: GitHub_M | Vendor: bearcove | Product: loona
Status : PUBLISHED

---

CVE-2024-51502 Description

loona is an experimental, HTTP/1.1 and HTTP/2 implementation in Rust on top of io-uring. `loona-hpack` suffers from the same vulnerability as the original `hpack` as documented in issue #11. All users who try to decode untrusted input using the Decoder are vulnerable to this exploit. This issue has been addressed in release version 0.4.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-755
CWE Name: CWE-755: Improper Handling of Exceptional Conditions
Source: bearcove

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).