{"id":"RUSTSEC-2026-0304","revision":null,"records":[{"revision":"582e42f9f44c4722ba35b8c6051c5126","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0304","aliases":["GHSA-jx5x-3mcr-qp8r"],"title":"Finished streaming calls keep reading a stalled request body indefinitely","description":"Affected versions of `connectrpc` start a background task to read the request body of every client-streaming and bidirectional-streaming call, before the interceptors or the handler run. A call can finish before it has consumed its request: the handler can return without reading all of its request stream, an interceptor can reject the call, or the request timeout can fire. The background task then keeps reading, with no time limit. If the client stops sending part-way through a message, or never sends the rest, the task, the partial message it has buffered (up to `max_message_size`, 4 MiB by default) and the HTTP/2 stream, or the HTTP/1.x connection, are held until the client finishes the stream or closes the connection.\n\n## Impact\n\nA client can use this to exhaust the memory, tasks and file descriptors of a server. With the default limits of the built-in `Server`, one HTTP/2 connection can hold 200 stalled streams, about 800 MiB at the default message size, and the server does not limit the number of connections. A server that authenticates in Tower middleware, before the request reaches the service, is exposed only to callers with a valid credential. A server with no authentication, or one that authenticates in an interceptor, is exposed to any client. This advisory covers client-streaming and bidirectional-streaming calls only.\n\n## Patches\n\nVersions 0.8.2 and 0.9.1 bound the wait. When the handler is gone, the reader frees the partial message and discards the rest of the body for at most 5 seconds and 1 MiB, then drops it, which resets the HTTP/2 stream or closes the HTTP/1.x connection. On `wasm32`, which has no clock, only the 1 MiB limit applies. Versions 0.2.0 to 0.7.0 contain the same reader and are not patched; upgrade to 0.8.2 or later.\n\n## Workarounds\n\nAuthenticate in Tower middleware rather than in an interceptor, so a request without a credential is rejected before any reader starts. Set `Server::with_max_connection_age`, which closes each connection, and every stalled body on it, once its age and the grace period have passed. Lowering `Limits::with_max_message_size` and `Server::with_max_concurrent_streams` reduces what one client can hold but does not release a stalled body.","state":0,"publishedAt":"2026-09-21T12:00:00+00:00","modifiedAt":"2026-09-23T07:45:03.3191256+00:00","affected":[{"ecosystem":"crates.io","name":"connectrpc","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.2.0"},{"kind":"fixed","version":"0.8.2"},{"kind":"introduced","version":"0.9.0"},{"kind":"fixed","version":"0.9.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":null,"severity":null}],"references":["https://crates.io/crates/connectrpc","https://rustsec.org/advisories/RUSTSEC-2026-0304.html","https://github.com/connectrpc/connect-rust/pull/313","https://github.com/connectrpc/connect-rust/pull/314","https://github.com/connectrpc/connect-rust/pull/315"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0304","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0304","identifiers":["RUSTSEC-2026-0304","GHSA-jx5x-3mcr-qp8r"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-12T19:18:40.2432846+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-12T19:18:40.2432846+00:00","lastSuccessAt":"2026-11-12T19:18:40.4588707+00:00","error":null,"lastVerifiedAt":"2026-11-12T19:18:40.458871+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-64752486c567b55b31fb0d7225f5222bcd0019564ac0ac5f0649e242c7b19299-71a71be06903c0321f16f785da414a43cf171b11fafd14dad0e93850c58a221f","complete":true,"records":424812,"lastAttemptAt":"2026-11-12T19:16:36.4552812+00:00","lastSuccessAt":"2026-11-12T19:16:36.099661+00:00","error":null,"lastVerifiedAt":"2026-11-12T19:16:36.4552812+00:00","snapshotPublishedAt":"2026-11-12T18:25:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-92f81c09e13d462186b63ad6d42bf56c","complete":true,"records":13775,"lastAttemptAt":"2026-11-12T19:19:06.4872466+00:00","lastSuccessAt":"2026-11-12T19:19:06.482+00:00","error":null,"lastVerifiedAt":"2026-11-12T19:19:06.482+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13828,"expectedIdentifiers":13828,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-12T19:18:40.2432846+00:00","complete":true,"records":1123,"lastAttemptAt":"2026-11-12T19:18:40.2432846+00:00","lastSuccessAt":"2026-11-12T19:18:40.459652+00:00","error":null,"lastVerifiedAt":"2026-11-12T19:18:40.4596522+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-5542c4cfe5304160aa85412ba73639c8","complete":true,"records":13775,"lastAttemptAt":"2026-11-12T19:19:05.6096222+00:00","lastSuccessAt":"2026-11-12T19:19:05.605+00:00","error":null,"lastVerifiedAt":"2026-11-12T19:19:05.605+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13828,"expectedIdentifiers":13828,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0a16b7a0ad9e3cbe2c8193b3ff308e03491784410561da4c005974a7742a693a","complete":true,"records":9947,"lastAttemptAt":"2026-11-12T19:18:40.1037842+00:00","lastSuccessAt":"2026-11-12T19:18:39.7950995+00:00","error":null,"lastVerifiedAt":"2026-11-12T19:18:40.1037842+00:00","snapshotPublishedAt":"2026-11-12T18:33:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-4d60731753a2f72e455d1086e7203d0ef10843936dcc1cf2b45135e2caa204b0","complete":true,"records":2012,"lastAttemptAt":"2026-11-12T19:16:36.615069+00:00","lastSuccessAt":"2026-11-12T18:16:50.7862525+00:00","error":null,"lastVerifiedAt":"2026-11-12T19:16:36.615069+00:00","snapshotPublishedAt":"2026-11-12T17:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-0d57668ba92a2918d0664e89ea91d467f8e6a2bc6330923eb883b74ac42a14ec","complete":true,"records":3125,"lastAttemptAt":"2026-11-12T19:18:40.2048041+00:00","lastSuccessAt":"2026-11-12T15:18:36.6112732+00:00","error":null,"lastVerifiedAt":"2026-11-12T19:18:40.2048041+00:00","snapshotPublishedAt":"2026-11-12T14:48:37+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-558c98a923b6de17949b5b6cab024e22e2f0e3b948d91b9ed9bca029f7b91e19","complete":true,"records":231722,"lastAttemptAt":"2026-11-12T19:18:30.8566334+00:00","lastSuccessAt":"2026-11-12T19:18:29.2862915+00:00","error":null,"lastVerifiedAt":"2026-11-12T19:18:30.8566334+00:00","snapshotPublishedAt":"2026-11-12T18:33:13+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}