Vulnerability RUSTSEC-2022-0066
High Risk
HIGH RISK
CVSS Score: 7.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
3 years ago
October 30, 2022 at 12:00 PM UTC
Denial of Service from unchecked request length
0.2.0-alpha.3 - 0.2.0 and 0.3.0 - 0.4.1
0.2.0-alpha.3 - 0.2.0 and 0.3.0 - 0.4.1
Summary
Denial of Service from unchecked request length
Details
Prior to version 0.4.2, conduit-hyper did not check any limit on a request's length before calling hyper::body::to_bytes. An attacker could send a malicious request with an abnormally large Content-Length, which could lead to a panic if memory allocation failed for that request.
In version 0.4.2, conduit-hyper sets an internal limit of 128 MiB per request, otherwise returning status 400 ("Bad Request").
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Impacted packages
Timeline
Published
3 years ago
October 30, 2022 at 12:00 PM UTC
Fixed (0.4.2)
3 years ago
October 30, 2022 at 08:06 PM UTC
Last Modified
1 hour ago
October 12, 2026 at 06:00 PM UTC