{"id":"RUSTSEC-2023-0001","revision":"00431d0bad7b4cc1901e47f476587a8a","records":[{"revision":"00431d0bad7b4cc1901e47f476587a8a","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2023-0001","aliases":["CVE-2023-22466","GHSA-7rrj-xr53-82p7"],"title":"reject_remote_clients Configuration corruption","description":"On Windows, configuring a named pipe server with [pipe_mode] will force [ServerOptions]::[reject_remote_clients] as `false`.\n\nThis drops any intended explicit configuration for the [reject_remote_clients] that may have been set as `true` previously.\n\nThe default setting of [reject_remote_clients] is normally `true` meaning the default is also overridden as `false`.\n\n## Workarounds\n\nEnsure that [pipe_mode] is set first after initializing a [ServerOptions]. For example:\n\n```rust\nlet mut opts = ServerOptions::new();\nopts.pipe_mode(PipeMode::Message);\nopts.reject_remote_clients(true);\n```\n\n[ServerOptions]: https://docs.rs/tokio/latest/tokio/net/windows/named_pipe/struct.ServerOptions.html\n[pipe_mode]: https://docs.rs/tokio/latest/tokio/net/windows/named_pipe/struct.ServerOptions.html#method.pipe_mode\n[reject_remote_clients]: https://docs.rs/tokio/latest/tokio/net/windows/named_pipe/struct.ServerOptions.html#method.reject_remote_clients","state":0,"publishedAt":"2023-01-04T12:00:00+00:00","modifiedAt":"2026-10-12T18:00:06.1156439+00:00","affected":[{"ecosystem":"crates.io","name":"tokio","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.7.0"},{"kind":"fixed","version":"1.18.4"},{"kind":"introduced","version":"1.19.0"},{"kind":"fixed","version":"1.20.3"},{"kind":"introduced","version":"1.21.0"},{"kind":"fixed","version":"1.23.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://crates.io/crates/tokio","https://rustsec.org/advisories/RUSTSEC-2023-0001.html","https://github.com/tokio-rs/tokio/pull/5336","https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createnamedpipea#pipe_reject_remote_clients"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2023-0001","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2023-0001","identifiers":["RUSTSEC-2023-0001","CVE-2023-22466","GHSA-7rrj-xr53-82p7"]},"retained":false,"historicalAffected":[]}],"coverage":[]}