VYPR
High severityNVD Advisory· Published Sep 14, 2022· Updated Aug 3, 2024

DoS in axum-core due to missing request size limit

CVE-2022-3212

Description

<bytes::Bytes as axum_core::extract::FromRequest>::from_request would not, by default, set a limit for the size of the request body. That meant if a malicious peer would send a very large (or infinite) body your server might run out of memory and crash. This also applies to these extractors which used Bytes::from_request internally: axum::extract::Form axum::extract::Json String

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
axum-corecrates.io
< 0.2.80.2.8
axum-corecrates.io
>= 0.3.0-rc.1, < 0.3.0-rc.20.3.0-rc.2

Affected products

1

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

0

No linked articles in our index yet.