CVE-2020-15694

In Nim 1.2.4, the standard library httpClient fails to properly validate the server response

published August 14, 2020

CVSS
—
EPSS
2%
Percentile
83.4
In the wild
Unconfirmed
What it is

In Nim 1.2.4, the standard library httpClient fails to properly validate the server response. For example, httpClient.get().contentLength() does not raise any error if a malicious server provides a negative Content-Length.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02331 · 83.4th percentile
Published
2020-08-14T18:48Z
EPSS history
Timeline
  • 14 AUG 18:48Z
    In Nim 1.2.4, the standard library httpClient fails to properly validate the server response
    cvelistv5