AIKIDO-2026-10922

TL;DR

A panic-safety flaw in HeaderMap::IntoIter::drop could cause already-yielded entries stored in extra_values to be dropped twice if a value’s destructor panics while the iterator is being drained, resulting in a double-free and potential memory corruption. An attacker might exploit this by supplying or influencing values with a panic-triggering Drop implementation, then causing partial iteration so that destruction occurs in this unsafe state, which could lead to process crashes, denial of service, or in some cases undefined behavior with possible security impact.