Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

conduit-hyper

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5crates.ioPublished

    conduit-hyper vulnerable to Denial of Service from unchecked request length

    CVE-2022-39294 · GHSA-9398-5ghf-7pr6

    Affected
    • crates.io conduit-hyper >= 0.2.0-alpha.3, < 0.4.2
    Fixed in
    0.4.2· Vendor fix available
    Issue
    Prior to version 0.4.2, conduit-hyper did not check any limit on a request's length before calling hyper::body::tobytes. An attacker could send a malicious request with an abnormally large Content-Length, which could lead to a panic if memory allocation failed for that request. In version 0.4.2, conduit-hyper sets an internal limit of 128 MiB per request, otherwise returning status 400 ("Bad Request"). This crate is part of the implementation of Rust's crates.io, but that service is not affected due to its existing cloud infrastructure, which already drops such malicious requests. Even with the new limit in place, conduit-hyper is not recommended for production use, nor to directly serve the public Internet. The vulnerability was discovered by Ori Hollander from the JFrog Security Research team.

    Recommended action: Upgrade to 0.4.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →