CVE-2022-39294Published

conduit-hyper integrates a conduit application with the hyper server. Prior to version 0.4.2, `conduit-hyper` did not check any limit on a request's length before calling [`hyper::body::to_bytes`](https://docs.rs/hyper/latest/hyper/body/fn.…

Exact source revision recorded 24 Oct 2026 21:17:10 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

nvd · CVE-2022-39294

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Modified

Weakness classifications: CWE-400 · CWE-1284

Original publisher date fields

published: 2022-10-31T19:15:10.593

lastModified: 2026-06-17T04:58:05.317

4 source CPE criteria · context only

cpe:2.3:a:conduit-hyper_project:conduit-hyper:*:*:*:*:*:rust:*:*
cpe:2.3:a:conduit-hyper_project:conduit-hyper:0.2.0:-:*:*:*:rust:*:*
cpe:2.3:a:conduit-hyper_project:conduit-hyper:0.2.0:alpha3:*:*:*:rust:*:*
cpe:2.3:a:conduit-hyper_project:conduit-hyper:0.2.0:alpha4:*:*:*:rust:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON