{"id":"EUVD-2022-7059","enisaUuid":"efda93e8-c975-3c10-bca3-ca09ab4ad155","description":"conduit-hyper integrates a conduit application with the hyper server. Prior to version 0.4.2, `conduit-hyper` did not check any limit on a request\u0027s length before calling [`hyper::body::to_bytes`](https://docs.rs/hyper/latest/hyper/body/fn.to_bytes.html). An attacker could send a malicious request with an abnormally large `Content-Length`, which could lead to a panic if memory allocation failed for that request. In version 0.4.2, `conduit-hyper` sets an internal limit of 128 MiB per request, otherwise returning status 400 (\"Bad Request\"). This crate is part of the implementation of Rust\u0027s [crates.io](https://crates.io/), but that service is not affected due to its existing cloud infrastructure, which already drops such malicious requests. Even with the new limit in place, `conduit-hyper` is not recommended for production use, nor to directly serve the public Internet.","datePublished":"Oct 31, 2022, 12:00:00 AM","dateUpdated":"Apr 23, 2025, 4:42:04 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/conduit-rust/conduit-hyper/security/advisories/GHSA-9398-5ghf-7pr6\n","aliases":"CVE-2022-39294\nGHSA-9398-5ghf-7pr6\n","assigner":"GitHub_M","epss":0.75,"enisaIdProduct":[{"id":"eb59a13d-44da-344d-be3e-74761337bbdd","product":{"name":"conduit-hyper","vendor":{"name":"conduit-rust"}},"product_version":"0.2.0-alpha.3, \u003c 0.4.2"}],"enisaIdVendor":[{"id":"c0a4195a-f255-3644-9365-0a4bb2a7cbd4","vendor":{"name":"conduit-rust"}}],"enisaIdVulnerability":[{"id":"1698718b-347a-3f59-b2ac-190f3fb01056","vulnerability":{"id":"GHSA-9398-5ghf-7pr6","description":"conduit-hyper vulnerable to Denial of Service from unchecked request length","datePublished":"Oct 31, 2022, 6:44:47 PM","dateUpdated":"Oct 31, 2022, 6:44:47 PM","baseScore":null,"references":"https://github.com/conduit-rust/conduit-hyper/security/advisories/GHSA-9398-5ghf-7pr6\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-39294\nhttps://github.com/conduit-rust/conduit-hyper/commit/4d225a53206505d39438ec6694e15f49c038baff\nhttps://github.com/conduit-rust/conduit-hyper\nhttps://rustsec.org/advisories/RUSTSEC-2022-0066.html\n","enisa_id":"EUVD-2022-7059\n","aliases":"CVE-2022-39294\nGHSA-9398-5ghf-7pr6\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:05:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"27b74c83-95be-3785-a8f6-8e1d290701e2","vulnerability":{"id":"CVE-2022-39294","description":"conduit-hyper integrates a conduit application with the hyper server. Prior to version 0.4.2, `conduit-hyper` did not check any limit on a request\u0027s length before calling [`hyper::body::to_bytes`](https://docs.rs/hyper/latest/hyper/body/fn.to_bytes.html). An attacker could send a malicious request with an abnormally large `Content-Length`, which could lead to a panic if memory allocation failed for that request. In version 0.4.2, `conduit-hyper` sets an internal limit of 128 MiB per request, otherwise returning status 400 (\"Bad Request\"). This crate is part of the implementation of Rust\u0027s [crates.io](https://crates.io/), but that service is not affected due to its existing cloud infrastructure, which already drops such malicious requests. Even with the new limit in place, `conduit-hyper` is not recommended for production use, nor to directly serve the public Internet.","datePublished":"Oct 31, 2022, 12:00:00 AM","dateUpdated":"Apr 23, 2025, 4:42:04 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/conduit-rust/conduit-hyper/security/advisories/GHSA-9398-5ghf-7pr6\n","enisa_id":"EUVD-2022-7059\n","assigner":"GitHub_M","epss":0.75,"dataProcessed":"Oct 24, 2026, 7:14:30 AM","vulnerabilityProduct":[{"id":"9270561b-1367-30e0-baf3-1f1395015c50","product":{"name":"conduit-hyper","vendor":{"name":"conduit-rust"}},"product_version":"0.2.0-alpha.3, \u003c 0.4.2"},{"id":"da00e4a8-2f32-4a7f-856f-26fa2e427ba9","product":{"name":"conduit-hyper","vendor":{"name":"conduit-rust"}},"product_version":"0.2.0-alpha.3, \u003c 0.4.2"}],"vulnerabilityVendor":[{"id":"66116a98-8791-3af9-a5d6-24627c800c8d","vendor":{"name":"conduit-rust"}}]}}],"enisaIdAdvisory":[]}