GHSA-fx4f-mhw4-qm7j: Integer Overflow
When using the affected versions of the vibeio-http crate, an attacker could craft a malicious HTTP/1.x request with a large chunk length (between usize::MAX - 1 and usize::MAX inclusive) and send it, causing the server to crash (integer overflow panic in debug builds, splitto out of bounds panic in release builds).
This was fixed in vibeio-http 0.3.2 by erroring on the chunk length if it exceeds usize::MAX - 2 (using checkedadd() instead of + operator), preventing integer overflow.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/vibeio-httpto a version that resolves this vulnerability.Fixed in 0.3.2 - Upgrade
Upgrade
vibeio-httpto a version that resolves this vulnerability.Fixed in 0.3.2
Event History
Frequently Asked Questions
What must an attacker be able to do to trigger the crash?
An attacker needs to send a malicious HTTP/1.x request containing a chunk length between usize::MAX - 1 and usize::MAX, inclusive, to a server using an affected vibeio-http version.
What is the impact in debug and release builds?
Debug builds panic from an integer overflow. Release builds panic when split_to is called out of bounds, causing the server to crash in either case.
Which version contains the fix?
vibeio-http 0.3.2 fixes the issue by rejecting chunk lengths greater than usize::MAX - 2, using checked_add() to prevent the overflow.