{"id":"RUSTSEC-2022-0066","revision":"b7f50753bfd041ed86e0fc5a80781f49","records":[{"revision":"b7f50753bfd041ed86e0fc5a80781f49","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2022-0066","aliases":["CVE-2022-39294","GHSA-9398-5ghf-7pr6"],"title":"Denial of Service from unchecked request length","description":"Prior to version 0.4.2, `conduit-hyper` did not check any limit on a request's\nlength before calling `hyper::body::to_bytes`. An attacker could send a\nmalicious request with an abnormally large `Content-Length`, which could lead\nto a panic if memory allocation failed for that request.\n\nIn version 0.4.2, `conduit-hyper` sets an internal limit of 128 MiB per\nrequest, otherwise returning status 400 (\"Bad Request\").","state":0,"publishedAt":"2022-10-30T12:00:00+00:00","modifiedAt":"2026-10-12T18:00:05.1163595+00:00","affected":[{"ecosystem":"crates.io","name":"conduit-hyper","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.2.0-alpha.3"},{"kind":"fixed","version":"0.4.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null}],"references":["https://crates.io/crates/conduit-hyper","https://rustsec.org/advisories/RUSTSEC-2022-0066.html","https://github.com/conduit-rust/conduit-hyper/commit/4d225a53206505d39438ec6694e15f49c038baff"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2022-0066","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2022-0066","identifiers":["RUSTSEC-2022-0066","CVE-2022-39294","GHSA-9398-5ghf-7pr6"]},"retained":false,"historicalAffected":[]}],"coverage":[]}