CVE-2022-39294: (DoS) Denial of Service from unchecked request length in conduit-hyper

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-10-31 · updated 2026-06-17
Weakness: CWE-400

Description

conduit-hyper integrates a conduit application with the hyper server. Prior to version 0.4.2, `conduit-hyper` did not check any limit on a request's length before calling [`hyper::body::to_bytes`](https://docs.rs/hyper/latest/hyper/body/fn.to_bytes.html). An attacker could send a malicious request with an abnormally large `Content-Length`, which could lead to a panic if memory allocation failed for that request. In version 0.4.2, `conduit-hyper` sets an internal limit of 128 MiB per request, otherwise returning status 400 ("Bad Request"). This crate is part of the implementation of Rust's [crates.io](https://crates.io/), but that service is not affected due to its existing cloud infrastructure, which already drops such malicious requests. Even with the new limit in place, `conduit-hyper` is not recommended for production use, nor to directly serve the public Internet.

Affected products

conduit-rust conduit-hyper: from 0.2.0 (excl.) before 0.4.2; 0.2.0, 0.2.0-alpha3, 0.2.0-alpha4 — fixed in 0.4.2

How to fix

Upgrade to a fixed version: conduit-rust conduit-hyper 0.4.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-39294 or the next vulnerability affects your stack