Vulnerability in Bearcove Loona
CVE-2024-51502
loona is an experimental, HTTP/1.1 and HTTP/2 implementation in Rust on top of io-uring. `loona-hpack` suffers from the same vulnerability as the original `hpack` as documented in issue #11. All users who try to decode untrusted input using the Decoder are vulnerable to this exploit. This issue has been addressed in release version 0.4.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.
EPSS: 0.005 (37.5th percentile) — read the EPSS interpretation.
Affected products
- Bearcove Loona — versions < 0.4.3
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-51502?
- CVE-2024-51502 is a vulnerability in Bearcove Loona, classified under Improper Handling of Exceptional Conditions. Published 2024-11-04.
- Is CVE-2024-51502 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.