« Volver al listado

CVE-2022-3212

Estado: ModificadaAlta (7.5)—

(bytes::Bytes como axum_core::extract::FromRequest)::from_request no establecía, por defecto, un límite para el tamaño del cuerpo de la petición. Esto significaba que si un compañero malicioso enviaba un cuerpo muy grande (o infinito) su servidor podría quedarse sin memoria y colapsar. Esto también se aplica a estos extractores que usan Bytes::from_request internamente: axum::extract::Form axum::extract::Json String

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Axum-core Project — Axum-core

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-3212",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "reefs@jfrog.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "reefs@jfrog.com",
      "affectedData": [
        {
          "vendor": "tokio-rs",
          "product": "axum-core",
          "versions": [
            {
              "status": "affected",
              "version": "0.3.0-rc.1"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "0.2.8",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-09-14T16:15:11.883",
  "references": [
    {
      "url": "https://research.jfrog.com/vulnerabilities/axum-core-dos/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "reefs@jfrog.com"
    },
    {
      "url": "https://rustsec.org/advisories/RUSTSEC-2022-0055.html",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "reefs@jfrog.com"
    },
    {
      "url": "https://research.jfrog.com/vulnerabilities/axum-core-dos/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://rustsec.org/advisories/RUSTSEC-2022-0055.html",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "reefs@jfrog.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "<bytes::Bytes as axum_core::extract::FromRequest>::from_request would not, by default, set a limit for the size of the request body. That meant if a malicious peer would send a very large (or infinite) body your server might run out of memory and crash. This also applies to these extractors which used Bytes::from_request internally: axum::extract::Form axum::extract::Json String"
    },
    {
      "lang": "es",
      "value": "(bytes::Bytes como axum_core::extract::FromRequest)::from_request no establecía, por defecto, un límite para el tamaño del cuerpo de la petición. Esto significaba que si un compañero malicioso enviaba un cuerpo muy grande (o infinito) su servidor podría quedarse sin memoria y colapsar. Esto también se aplica a estos extractores que usan Bytes::from_request internamente: axum::extract::Form axum::extract::Json String"
    }
  ],
  "lastModified": "2026-06-17T04:59:05.120",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:axum-core_project:axum-core:*:*:*:*:*:rust:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3C75C001-9583-4589-B223-CFC88D83DC6F",
              "versionEndExcluding": "0.2.8"
            },
            {
              "criteria": "cpe:2.3:a:axum-core_project:axum-core:0.3.0:rc1:*:*:*:rust:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BAA28945-A516-4F1E-99FF-470141986E69"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "reefs@jfrog.com"
}