High severityNVD Advisory· Published Sep 14, 2022· Updated Aug 3, 2024
DoS in axum-core due to missing request size limit
CVE-2022-3212
Description
<bytes::Bytes as axum_core::extract::FromRequest>::from_request would not, by default, set a limit for the size of the request body. That meant if a malicious peer would send a very large (or infinite) body your server might run out of memory and crash. This also applies to these extractors which used Bytes::from_request internally: axum::extract::Form axum::extract::Json String
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
axum-corecrates.io | < 0.2.8 | 0.2.8 |
axum-corecrates.io | >= 0.3.0-rc.1, < 0.3.0-rc.2 | 0.3.0-rc.2 |
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
5- github.com/advisories/GHSA-m77f-652q-wwp4ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-3212ghsaADVISORY
- github.com/tokio-rs/axum/pull/1346ghsaWEB
- research.jfrog.com/vulnerabilities/axum-core-dos/mitrex_refsource_MISC
- rustsec.org/advisories/RUSTSEC-2022-0055.htmlghsax_refsource_MISCWEB
News mentions
0No linked articles in our index yet.