Description
<bytes::Bytes as axum_core::extract::FromRequest>::from_request would not, by default, set a limit for the size of the request body. That meant if a malicious peer would send a very large (or infinite) body your server might run out of memory and crash. This also applies to these extractors which used Bytes::from_request internally: axum::extract::Form axum::extract::Json String
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| tokio-rs | axum-core | 0.3.0-rc.1, unspecified – < 0.2.8 | 0.2.8 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | axum-core | < 0.2.8 | 0.2.8 | GHSA-m77f-652q-wwp4 |
| crates.io | axum-core | >= 0.3.0-rc.1, < 0.3.0-rc.2 | 0.3.0-rc.2 | GHSA-m77f-652q-wwp4 |
| crates.io | axum-core | >= 0.0.0-0, < 0.2.8 · >= 0.3.0-rc.1, < 0.3.0-rc.2 | 0.2.8, 0.3.0-rc.2 | RUSTSEC-2022-0055 |