CVE-2022-3212
High
Description
<bytes::Bytes as axum_core::extract::FromRequest>::from_request would not, by default, set a limit for the size of the request body. That meant if a malicious peer would send a very large (or infinite) body your server might run out of memory and crash. This also applies to these extractors which used Bytes::from_request internally: axum::extract::Form axum::extract::Json String
SeverityHigh
CVSS7.5
Exploit probability—
ProductAxum-core
PublishedSep 14, 2022
First seenSep 14, 2022
Weakness typeCWE-770Allocation of resources without limits
How to fix
Update
- axum-core_project axum-core0.2.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| axum-core_project axum-core | v < 0.2.8, 0.3.0 | 0.2.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.