PT-2023-8461 · Hyper+2 · Hyper+2
Qinyushun
·
Publicado
2023-02-21
·
Atualizado
2025-03-17
·
CVE-2022-31394
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Hyper versions prior to 0.14.19
Description
The issue is related to the HTTP library for Rust Hyper, which is associated with unbounded resource allocation. This can be exploited by a remote attacker to cause a denial of service. The vulnerability is also related to the lack of customization for the
max header list size method in the H2 third-party software, allowing attackers to perform HTTP2 attacks.Recommendations
For versions prior to 0.14.19, update to version 0.14.19 or later to resolve the issue. As a temporary workaround, consider restricting access to the H2 third-party software to minimize the risk of exploitation. Avoid using the
max header list size method in affected API endpoints until the issue is resolved.Exploit
Correção
Allocation of Resources Without Limits
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
H2
Hyper
Suse