CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2022-3212
High (7.5) in axum-core project axum-core. EPSS 1.0% chance of exploitation in the next 30 days. Fixed in axum-core 0.2.8, 0.3.0-rc.2.
<bytes::Bytes as axum_core::extract::FromRequest>::from_request would not, by default, set a limit for the size of the request body. That meant if a malicious peer would send a very large (or infinite) body your server might run out of memory and crash. This also applies to these extractors which used Bytes::from_request internally: axum::extract::Form axum::extract::Json String
Severity
- EPSS
- 1.0% chance of exploitation in the next 30 days; higher than 62% of CVEs (scores of 2026-11-01)
- CWE
- CWE-770
- Published
- Modified
- Record from
- the NVD, synced
Affected
- axum-core_project:axum-core
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-m77f-652q-wwp4 | crates.io | axum-core | <0.2.8 | 0.2.8 |
| GHSA-m77f-652q-wwp4 | crates.io | axum-core | >=0.3.0-rc.1 <0.3.0-rc.2 | 0.3.0-rc.2 |
| RUSTSEC-2022-0055 | crates.io | axum-core | >=0.0.0-0 <0.2.8 >=0.3.0-rc.1 <0.3.0-rc.2 | 0.2.8, 0.3.0-rc.2 |