advisory-db/crates/chttp/RUSTSEC-2019-0016.md

[advisory]
id = "RUSTSEC-2019-0016"
package = "chttp"
aliases = ["CVE-2019-16140", "GHSA-5rrv-m36h-qwf8"]
cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
date = "2019-09-01"
keywords = ["memory-management", "memory-corruption"]
url = "https://github.com/sagebind/isahc/issues/2"

[versions]
patched = [">= 0.1.3"]
unaffected = ["< 0.1.1"]

Use-after-free in buffer conversion implementation

The From implementation for Vec was not properly implemented, returning a vector backed by freed memory. This could lead to memory corruption or be exploited to cause undefined behavior.

A fix was published in version 0.1.3.