CVE-2022-31394
Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method...
Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform HTTP2 attacks.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform HTTP2 attacks.
- Record
CVE-2022-31394- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
CVE List
Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform HTTP2 attacks.
- Record
CVE-2022-31394- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2022-52907
Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform HTTP2 attacks.
- Record
EUVD-2022-52907- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-x477-xp89-wc9r
Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method...
Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform HTTP2 attacks.
- Record
GHSA-x477-xp89-wc9r- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVAZL-13685
CVE-2022-31394 affecting package rpm-ostree for versions less than 2022.1-4
Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform HTTP2 attacks.
- Record
AZL-13685- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-35218
CVE-2022-31394 affecting package rpm-ostree for versions less than 2022.1-7
Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform HTTP2 attacks.
- Record
AZL-35218- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 14 moreShow less
OSVAZL-61516
CVE-2022-31394 affecting package rust for versions less than hyper-0.14.25
Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform HTTP2 attacks.
- Record
AZL-61516- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform HTTP2 attacks.
- Record
CVE-2022-31394- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVJLSEC-2026-20
Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform HTTP2 attacks.
- Record
JLSEC-2026-20- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-31394 No score
Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform HTTP2 attacks.
- Record
DEBIAN-CVE-2022-31394- Updated
- 2026-11-03
OSVopenSUSE-SU-2024:12727-1 No score
rustup-1.25.2~0-2.1 on GA media
These are all security issues fixed in the rustup-1.25.2~0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12727-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12728-1 No score
sccache-0.4.0pre.7~0-2.1 on GA media
These are all security issues fixed in the sccache-0.4.0pre.7~0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12728-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12757-1 No score
aws-nitro-enclaves-binaryblobs-upstream-1.2.2~git0.4ccc639-1.1 on GA media
These are all security issues fixed in the aws-nitro-enclaves-binaryblobs-upstream-1.2.2~git0.4ccc639-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12757-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12764-1 No score
pijul-1.0.0~beta.4-1.1 on GA media
These are all security issues fixed in the pijul-1.0.0~beta.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12764-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12807-1 No score
wasm-pack-0.11.0~0-1.1 on GA media
These are all security issues fixed in the wasm-pack-0.11.0~0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12807-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:1844-1 No score
Security update for aws-nitro-enclaves-cli
This update for aws-nitro-enclaves-cli fixes the following issues:
Update aws-nitro-enclaves-cli to version 1.2.2~git0.4ccc639:
- CVE-2022-31394: Fixed DoS vulnerability in hyper crate (bsc#1208555).
Update aws-nitro-enclaves-cli to version 1.2.0~git2.841ef94:
- CVE-2022-24713: Fixed ReDoS vulnerability in regex crate (bsc#1196972).
- Record
SUSE-SU-2023:1844-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:2603-1 No score
Security update for rustup
This update for rustup fixes the following issues:
- CVE-2022-31394: Fixed possible HTTP2 attacks by specifying the HTTP/2 SETTINGS_MAX_HEADER_LIST_SIZE (bsc#1208552).
- CVE-2023-26964: Fixed high memory and CPU usage when stream stacking occurs when H2 processes HTTP2 RST_STREAM frames (bsc#1210345).
- Record
SUSE-SU-2023:2603-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:2637-1 No score
Security update for sccache
This update for sccache fixes the following issues:
- CVE-2023-1521: Fixed possible code injection via LD_PRELOAD to sccache server (bsc#1212407).
- CVE-2022-31394: Fixed a denial-of-service vulnerability via header list size (bsc#1208553).
- Record
SUSE-SU-2023:2637-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:3526-1 No score
Security update for sccache
This update for sccache fixes the following issues:
- Update to version 0.4.2.
- CVE-2021-45710: Fixed a segmentation fault due to data race in tokio crate. (bsc#1194119)
- CVE-2022-24713: Fixed a ReDoS issue due to vulnerable regex crate. (bsc#1196972)
- CVE-2022-31394: Fixed a DoS issue due to the max header list size not settable. (bsc#1208553)
- CVE-2023-1521: Fixed a local privilege escalation. (bsc#1212407)
- Record
SUSE-SU-2023:3526-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:0090-1 No score
Security update for gstreamer-plugins-rs
This update for gstreamer-plugins-rs fixes the following issues:
- CVE-2022-31394: Fixed a potential denial of service in the HTTP/2 implementation (bsc#1208556).
- Record
SUSE-SU-2024:0090-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rpm-ostreeAzure Linux:2 |
before 2022.1-4 | 2022.1-4 |
rpm-ostreeAzure Linux:3 |
before 2022.1-7 | 2022.1-7 |
rustAzure Linux:3 |
1.85.0 up to hyper-0.14.25 | hyper-0.14.25 |
rust-hyperDebian:12 |
before 0.14.19-1 | 0.14.19-1 |
rust-hyperDebian:13 |
before 0.14.19-1 | 0.14.19-1 |
rust-hyperDebian:14 |
before 0.14.19-1 | 0.14.19-1 |
hyper_jllJulia |
before 0.14.19+0 | 0.14.19+0 |
aws-nitro-enclaves-cliSUSE:Linux Enterprise Module for Public Cloud 15 SP4 From an advisory covering 2 CVEs |
before 1.2.2~git0.4ccc639-150400.3.3.1 | 1.2.2~git0.4ccc639-150400.3.3.1 |
aws-nitro-enclaves-cliopenSUSE:Leap 15.4 From an advisory covering 2 CVEs |
before 1.2.2~git0.4ccc639-150400.3.3.1 | 1.2.2~git0.4ccc639-150400.3.3.1 |
rustupSUSE:Linux Enterprise Module for Development Tools 15 SP4 From an advisory covering 2 CVEs |
before 1.26.0~0-150400.3.7.1 | 1.26.0~0-150400.3.7.1 |
Show 20 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rustupSUSE:Linux Enterprise Module for Development Tools 15 SP5 From an advisory covering 2 CVEs |
before 1.26.0~0-150400.3.7.1 | 1.26.0~0-150400.3.7.1 |
rustupopenSUSE:Leap 15.4 From an advisory covering 2 CVEs |
before 1.26.0~0-150400.3.7.1 | 1.26.0~0-150400.3.7.1 |
rustupopenSUSE:Leap 15.5 From an advisory covering 2 CVEs |
before 1.26.0~0-150400.3.7.1 | 1.26.0~0-150400.3.7.1 |
sccacheSUSE:Linux Enterprise Module for Development Tools 15 SP5 From an advisory covering 2 CVEs |
before 0.4.1~18-150300.7.12.1 | 0.4.1~18-150300.7.12.1 |
sccacheSUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS From an advisory covering 2 CVEs |
before 0.4.1~18-150300.7.12.1 | 0.4.1~18-150300.7.12.1 |
sccacheSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 2 CVEs |
before 0.4.1~18-150300.7.12.1 | 0.4.1~18-150300.7.12.1 |
sccacheSUSE:Linux Enterprise Real Time 15 SP3 From an advisory covering 2 CVEs |
before 0.4.1~18-150300.7.12.1 | 0.4.1~18-150300.7.12.1 |
sccacheSUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 2 CVEs |
before 0.4.1~18-150300.7.12.1 | 0.4.1~18-150300.7.12.1 |
sccacheSUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 2 CVEs |
before 0.4.1~18-150300.7.12.1 | 0.4.1~18-150300.7.12.1 |
sccacheSUSE:Enterprise Storage 7.1 From an advisory covering 2 CVEs |
before 0.4.1~18-150300.7.12.1 | 0.4.1~18-150300.7.12.1 |
sccacheSUSE:Linux Enterprise Module for Development Tools 15 SP4 From an advisory covering 4 CVEs |
before 0.4.2~3-150400.3.3.1 | 0.4.2~3-150400.3.3.1 |
sccacheSUSE:Linux Enterprise Module for Development Tools 15 SP5 From an advisory covering 4 CVEs |
before 0.4.2~3-150400.3.3.1 | 0.4.2~3-150400.3.3.1 |
sccacheopenSUSE:Leap 15.4 From an advisory covering 4 CVEs |
before 0.4.2~3-150400.3.3.1 | 0.4.2~3-150400.3.3.1 |
sccacheopenSUSE:Leap 15.5 From an advisory covering 4 CVEs |
before 0.4.2~3-150400.3.3.1 | 0.4.2~3-150400.3.3.1 |
gstreamer-plugins-rsSUSE:Linux Enterprise Module for Desktop Applications 15 SP5 |
before 0.8.2-150400.3.3.1 | 0.8.2-150400.3.3.1 |
gstreamer-plugins-rsSUSE:Linux Enterprise Real Time 15 SP4 |
before 0.8.2-150400.3.3.1 | 0.8.2-150400.3.3.1 |
rustupopenSUSE:Tumbleweed |
before 1.25.2~0-2.1 | 1.25.2~0-2.1 |
sccacheopenSUSE:Tumbleweed |
before 0.4.0pre.7~0-2.1 | 0.4.0pre.7~0-2.1 |
pijulopenSUSE:Tumbleweed |
before 1.0.0~beta.4-1.1 | 1.0.0~beta.4-1.1 |
wasm-packopenSUSE:Tumbleweed |
before 0.11.0~0-1.1 | 0.11.0~0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-31394 is a high vulnerability (CVSS 7.5) in Hyper, published February 21, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.08%, the 65th percentile. Fixed in rpm-ostree 2022.1-4.
References
github.com/hyperium/hyper/issues/2826
nvd.nist.gov/vuln/detail/CVE-2022-31394
Show 20 moreShow less
security-tracker.debian.org/tracker/CVE-2022-31394
suse.com/support/update/announcement/2023/suse-su-20231844-1
bugzilla.suse.com/1196972