High severity7.5NVD Advisory· Published Sep 14, 2022· Updated Jun 17, 2026
CVE-2022-3212
CVE-2022-3212
Description
<bytes::Bytes as axum_core::extract::FromRequest>::from_request would not, by default, set a limit for the size of the request body. That meant if a malicious peer would send a very large (or infinite) body your server might run out of memory and crash. This also applies to these extractors which used Bytes::from_request internally: axum::extract::Form axum::extract::Json String
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
axum-corecrates.io | < 0.2.8 | 0.2.8 |
axum-corecrates.io | >= 0.3.0-rc.1, < 0.3.0-rc.2 | 0.3.0-rc.2 |
Affected products
4cpe:2.3:a:axum-core_project:axum-core:*:*:*:*:*:rust:*:*+ 1 more
- cpe:2.3:a:axum-core_project:axum-core:*:*:*:*:*:rust:*:*range: <0.2.8
- cpe:2.3:a:axum-core_project:axum-core:0.3.0:rc1:*:*:*:rust:*:*
Patches
Vulnerability mechanics
References
5- research.jfrog.com/vulnerabilities/axum-core-dos/nvdExploitThird Party Advisory
- rustsec.org/advisories/RUSTSEC-2022-0055.htmlnvdExploitIssue TrackingPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-m77f-652q-wwp4ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-3212ghsaADVISORY
- github.com/tokio-rs/axum/pull/1346ghsaWEB
News mentions
0No linked articles in our index yet.