CVE-2026-109338: Rust Header Value To Str Panic On Non Ascii
`$VAL.to_str()` is unwrapped with a panicking combinator, asserting that the header value is entirely visible ASCII. HTTP header values are opaque bytes (RFC 9110): `HeaderValue::from_bytes` accepts non-ASCII bytes (0x80-0xFF) that `to_str()` rejects, and values pulled from a fetched response's HeaderMap (or stored from script input via `from_bytes`) carry w
Rustgreprules fetch cve-2026-109338-rust-header-value-to-str-panic-on-non-ascii --engine opengrepDescription
`$VAL.to_str()` is unwrapped with a panicking combinator, asserting that the header value is entirely visible ASCII. HTTP header values are opaque bytes (RFC 9110): `HeaderValue::from_bytes` accepts non-ASCII bytes (0x80-0xFF) that `to_str()` rejects, and values pulled from a fetched response's HeaderMap (or stored from script input via `from_bytes`) carry w
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.