The issue is in the HTTP Basic Authentication parser used by imhttp. When decoding an oversized Basic Authentication header, instead of allocating
len bytes. If imhttp Basic Authentication was enabled, a remote client able to
reach the imhttp listener could trigger heap memory corruption. The practical
expected impact is denial of service; stronger impact would depend on platform,
allocator behavior, compiler options, and process hardening.