Rust advisories / conduit-hyper
Vulnerability HighRUSTSEC-2022-0066 · conduit-hyper
RUSTSEC-2022-0066: Denial of Service from unchecked request length
Short answerA security vulnerability in the conduit-hyper crate: Denial of Service from unchecked request length. High severity (CVSS 7.5). Fixed in 0.4.2: update to a fixed version.
| Crate | conduit-hyper |
|---|---|
| Type | Vulnerability (denial-of-service) |
| Affected versions | From 0.2.0-alpha.3 before 0.4.2. |
| Fixed in | 0.4.2 |
| Severity | High, CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| Published | 2022-10-30 |
| Last changed | 2026-10-12 |
| Also known as | CVE-2022-39294, GHSA-9398-5ghf-7pr6 |
What to do
- See which version you have:
cargo tree -i conduit-hyper(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p conduit-hyper. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for exampleconduit-hyper = "0.4.2") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
Prior to version 0.4.2, conduit-hyper did not check any limit on a request's length before calling hyper::body::to_bytes. An attacker could send a malicious request with an abnormally large Content-Length, which could lead to a panic if memory allocation failed for that request.
In version 0.4.2, conduit-hyper sets an internal limit of 128 MiB per request, otherwise returning status 400 ("Bad Request").
References
- Package: crates.io/crates/conduit-hyper
- Advisory: rustsec.org/advisories/RUSTSEC-2022-0066.html
- Web: github.com/conduit-rust/conduit-hyper/commit/4d225a53206505d39438ec6694e15f49c038baff
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?