CVE-2020-15694

Name of the Vulnerable Software and Affected Versions Nim version 1.2.4

Description The standard library httpClient in Nim fails to properly validate the server response. For instance, httpClient.get().contentLength() does not raise an error if a malicious server provides a negative Content-Length.

Recommendations For Nim version 1.2.4, consider validating server responses manually to ensure the Content-Length is not negative until a patch is available. As a temporary workaround, restrict the use of httpClient.get().contentLength() to minimize the risk of exploitation.