Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
The nostr crate versions before 0.44.7 are vulnerable to resource exhaustion through the NIP-98 HTTP authorization parser, which decodes and parses the full Authorization: Nostr value before checking its size or signature. An unauthenticated remote client can send oversized headers to a server using this parser, consuming memory and CPU, though authentication is not bypassed and no data is disclosed. Upgrade to nostr 0.44.7 or later, which rejects oversized input.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 7.5 | High | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | OSV |
- CISA KEV Not listed.
- EPSS No score.
Timeline
- 31 Oct 2026, 15:18 UTC First seen by agentprime
- 31 Oct 2026, 15:18 UTC Confirmed by OSV