CVE-2022-3212 DoS in axum-core due to missing request size limit
Attackers can crash servers by sending excessively large request bodies due to missing default size limits in axum-core extractors.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-3212?
CVE-2022-3212 is a high-severity denial of service vulnerability in tokio-rs axum-core, published on 14 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
<bytes::Bytes as axum_core::extract::FromRequest>::from_request would not, by default, set a limit for the size of the request body. That meant if a malicious peer would send a very large (or infinite) body your server might run out of memory and crash. This also applies to these extractors which used Bytes::from_request internally: axum::extract::Form axum::extract::Json String
Weakness: CWE-770
Which versions are affected by CVE-2022-3212?
5 open source packages ship an affected version, including axum-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
axum-core crates.io | All versions | 0.2.8 |
axum-core crates.io | All versions | 0.2.8 |
axum-core crates.io | From 0.0.0-0 | 0.2.8, 0.3.0-rc.2 |
axum-core crates.io | From 0.3.0-rc.1 | 0.3.0-rc.2 |
axum-core crates.io | From 0.3.0-rc.1 | 0.3.0-rc.2 |
Products include Axum-Core Project Axum-Core.
How do I fix CVE-2022-3212?
Upgrade axum-core to a fixed version for your release line: 0.2.8 or 0.3.0-rc.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-3212 being exploited?
There is no known exploitation of CVE-2022-3212 in the wild and no public exploit code.
Sources
Also known as GHSA-m77f-652q-wwp4, RUSTSEC-2022-0055.