{"id":"CVE-2022-3212","aliases":["EUVD-2022-6873","GHSA-m77f-652q-wwp4","RUSTSEC-2022-0055"],"status":"published","title":"DoS in axum-core due to missing request size limit","description":"\u003cbytes::Bytes as axum_core::extract::FromRequest\u003e::from_request would not, by default, set a limit for the size of the request body. That meant if a malicious peer would send a very large (or infinite) body your server might run out of memory and crash. This also applies to these extractors which used Bytes::from_request internally: axum::extract::Form axum::extract::Json String","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01024,"percentile":0.64,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2022-08-31T12:00:00Z","modified":"2026-06-17T04:59:05Z","fixes":[{"ecosystem":"crates.io","package":"axum-core","fixed_in":["0.2.8","0.3.0-rc.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"axum-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.8"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"axum-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.0-rc.1"},{"last_affected":"0.3.0-rc.1"},{"fixed":"0.3.0-rc.2"}]}],"versions":["0.3.0-rc.1"]},{"source":"osv","ecosystem":"crates.io","package":"axum-core","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.2.8"}]}]},{"source":"osv","ecosystem":"crates.io","package":"axum-core","ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.0-rc.1"},{"fixed":"0.3.0-rc.2"}]}],"versions":["0.3.0-rc.1"]},{"source":"osv","ecosystem":"crates.io","package":"axum-core","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.2.8"},{"introduced":"0.3.0-rc.1"},{"fixed":"0.3.0-rc.2"}]}]}],"products":[{"vendor":"axum-core_project","product":"axum-core"},{"vendor":"tokio-rs","product":"axum-core"}],"references":[{"url":"https://research.jfrog.com/vulnerabilities/axum-core-dos/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2022-0055.html","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","web","advisory"]},{"url":"https://github.com/tokio-rs/axum/pull/1346","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3212","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-m77f-652q-wwp4"},{"url":"https://github.com/tokio-rs/axum","tags":["package"]},{"url":"https://crates.io/crates/axum-core","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-3212","title":"DoS in axum-core due to missing request size limit","description":"\u003cbytes::Bytes as axum_core::extract::FromRequest\u003e::from_request would not, by default, set a limit for the size of the request body. That meant if a malicious peer would send a very large (or infinite) body your server might run out of memory and crash. This also applies to these extractors which used Bytes::from_request internally: axum::extract::Form axum::extract::Json String","status":"published","published":"2022-09-14T16:05:09Z","modified":"2024-08-03T01:00:10.862Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:34:32.843656Z"}],"euvd":[{"id":"EUVD-2022-6873","description":"\u003cbytes::Bytes as axum_core::extract::FromRequest\u003e::from_request would not, by default, set a limit for the size of the request body. That meant if a malicious peer would send a very large (or infinite) body your server might run out of memory and crash. This also applies to these extractors which used Bytes::from_request internally: axum::extract::Form axum::extract::Json String","status":"published","published":"2022-09-14T16:05:09Z","modified":"2024-08-03T01:00:10Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T03:25:56.994006Z"}],"ghsa":[{"id":"GHSA-m77f-652q-wwp4","title":"axum-core has no default limit put on request bodies","description":"`\u003cbytes::Bytes as axum_core::extract::FromRequest\u003e::from_request` would not, by default, set a limit for the size of the request body. That meant if a malicious peer would send a very large (or infinite) body your server might run out of memory and crash.\n\nThis also applies to these extractors which used `Bytes::from_request` internally:\n- `axum::extract::Form`\n- `axum::extract::Json`\n- `String`\n\nThe fix is also in `axum-core` `0.3.0.rc.2` but `0.3.0.rc.1` _is_ vulnerable.\n\nBecause `axum` depends on `axum-core` it is vulnerable as well. The vulnerable versions of `axum` are `\u003c= 0.5.15` and `0.6.0.rc.1`. `axum` `\u003e= 0.5.16` and `\u003e= 0.6.0.rc.2` does have the fix and are not vulnerable.\n\nThe patched versions will set a 2 MB limit by default.\n","status":"published","published":"2022-09-15T03:25:15Z","modified":"2023-01-12T05:08:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:36:14.033357Z"}],"nvd":[{"id":"CVE-2022-3212","description":"\u003cbytes::Bytes as axum_core::extract::FromRequest\u003e::from_request would not, by default, set a limit for the size of the request body. That meant if a malicious peer would send a very large (or infinite) body your server might run out of memory and crash. This also applies to these extractors which used Bytes::from_request internally: axum::extract::Form axum::extract::Json String","status":"published","published":"2022-09-14T16:15:11.883Z","modified":"2026-06-17T04:59:05.12Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:07:27.631109Z"}],"osv":[{"id":"GHSA-m77f-652q-wwp4","title":"axum-core has no default limit put on request bodies","description":"`\u003cbytes::Bytes as axum_core::extract::FromRequest\u003e::from_request` would not, by default, set a limit for the size of the request body. That meant if a malicious peer would send a very large (or infinite) body your server might run out of memory and crash.\n\nThis also applies to these extractors which used `Bytes::from_request` internally:\n- `axum::extract::Form`\n- `axum::extract::Json`\n- `String`\n\nThe fix is also in `axum-core` `0.3.0.rc.2` but `0.3.0.rc.1` _is_ vulnerable.\n\nBecause `axum` depends on `axum-core` it is vulnerable as well. The vulnerable versions of `axum` are `\u003c= 0.5.15` and `0.6.0.rc.1`. `axum` `\u003e= 0.5.16` and `\u003e= 0.6.0.rc.2` does have the fix and are not vulnerable.\n\nThe patched versions will set a 2 MB limit by default.\n","status":"published","published":"2022-09-15T03:25:15Z","modified":"2023-11-08T04:09:34.414125Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:51.463834Z"},{"id":"RUSTSEC-2022-0055","title":"No default limit put on request bodies","description":"`\u003cbytes::Bytes as axum_core::extract::FromRequest\u003e::from_request` would not, by\ndefault, set a limit for the size of the request body. That meant if a malicious\npeer would send a very large (or infinite) body your server might run out of\nmemory and crash.\n\nThis also applies to these extractors which used `Bytes::from_request`\ninternally:\n- `axum::extract::Form`\n- `axum::extract::Json`\n- `String`\n\nThe fix is also in `axum-core` `0.3.0.rc.2` but `0.3.0.rc.1` _is_ vulnerable.\n\nBecause `axum` depends on `axum-core` it is vulnerable as well. The vulnerable\nversions of `axum` are `\u003c= 0.5.15` and `0.6.0.rc.1`. `axum` `\u003e= 0.5.16` and\n`\u003e= 0.6.0.rc.2` does have the fix and are not vulnerable.\n\nThe patched versions will set a 2 MB limit by default.","status":"published","published":"2022-08-31T12:00:00Z","modified":"2023-11-08T04:09:34.414125Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}