PT-2023-8461 · Hyper+2 · Hyper+2
Qinyushun
·
Published
2023-02-21
·
Updated
2025-03-17
·
CVE-2022-31394
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Hyper versions prior to 0.14.19
Description
The issue is related to the HTTP library for Rust Hyper, which is associated with unbounded resource allocation. This can be exploited by a remote attacker to cause a denial of service. The vulnerability is also related to the lack of customization for the
max header list size method in the H2 third-party software, allowing attackers to perform HTTP2 attacks.Recommendations
For versions prior to 0.14.19, update to version 0.14.19 or later to resolve the issue. As a temporary workaround, consider restricting access to the H2 third-party software to minimize the risk of exploitation. Avoid using the
max header list size method in affected API endpoints until the issue is resolved.Exploit
Fix
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
H2
Hyper
Suse