CVE-2019-25009

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in the http crate before 0.1.20 for Rust. The HeaderMap::Drain API can use a raw pointer, defeating soundness.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-415

Affected software

No affected versions have been published.

Timeline

Published
Dec 31, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-25013.8Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are CVE-2019-250109.8An issue was discovered in the failure crate through 2019-11-13 for Rust. Type confusion can occur when __private_get_type_id__ is overriddeCVE-2019-250115.4NetBox through 2.6.2 allows an Authenticated User to conduct an XSS attack against an admin via a GFM-rendered field, as demonstrated by /dcCVE-2019-250127.5The Webform Report project 7.x-1.x-dev for Drupal allows remote attackers to view submissions by visiting the /rss.xml page. NOTE: This projCVE-2019-250135.9The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR eCVE-2019-250146.5A NULL pointer dereference was found in pkg/proxy/envoy/v2/debug.go getResourceVersion in Istio pilot before 1.5.0-alpha.0. If a particular CVE-2019-250155.4LuCI in OpenWrt 18.06.0 through 18.06.4 allows stored XSS via a crafted SSID.CVE-2019-250168.8In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowedCVE-2019-250175.9An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp, the server choosesCVE-2019-250187.5In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access restrictions via the filename of . or an emCVE-2019-250199.8LimeSurvey before 4.0.0-RC4 allows SQL injection via the participant model.CVE-2019-25024.9Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 8.0.13 and prio
CVE-2019-25009: Critical severity, CVSS 9.8 | Vulnix