CVE-2022-31394 Denial of service in n/a
Attackers can cause denial of service via HTTP2 attacks because the library lacks customization for max_header_list_size.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-31394?
CVE-2022-31394 is a high-severity denial of service vulnerability in n/a, published on 21 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform HTTP2 attacks.
Weakness: CWE-770
Which versions are affected by CVE-2022-31394?
It affects 1 product.
Linux distribution packages (6)
gstreamer-plugins-rs SUSE:Linux Enterprise Module for Desktop Applications 15 SP5 | All versions | 0.8.2-150400.3.3.1 |
gstreamer-plugins-rs SUSE:Linux Enterprise Real Time 15 SP4 | All versions | 0.8.2-150400.3.3.1 |
pijul openSUSE:Tumbleweed | All versions | 1.0.0~beta.4-1.1 |
rustup openSUSE:Tumbleweed | All versions | 1.25.2~0-2.1 |
sccache openSUSE:Tumbleweed | All versions | 0.4.0pre.7~0-2.1 |
wasm-pack openSUSE:Tumbleweed | All versions | 0.11.0~0-1.1 |
Products include Hyper Hyper.
How do I fix CVE-2022-31394?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-31394 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-31394 exists.
Other vulnerabilities in n/a
- CVE-2020-35863 HTTP Request Smuggling in hyper
- CVE-2021-32714 Integer Overflow in Chunked Transfer-Encoding
- CVE-2017-18587 Headers containing newline characters can split messages in hyper
- CVE-2021-21299 Multiple Transfer-Encoding headers misinterprets request payload
- CVE-2016-10932 HTTPS MitM vulnerability due to lack of hostname verification
Sources
Also known as AZL-13685, AZL-35218, AZL-61516, DEBIAN-CVE-2022-31394, GHSA-x477-xp89-wc9r, JLSEC-2026-20 and 6 more.