{"id":"GHSA-fx4f-mhw4-qm7j","aliases":["RUSTSEC-2026-0181"],"status":"published","title":"vibeio-http has a DoS vulnerability in HTTP/1.x chunked encoding parser triggered by maliciously crafted chunk lengths","description":"When using the affected versions of the `vibeio-http` crate, an attacker could craft a malicious HTTP/1.x request with a large chunk length (between `usize::MAX - 1` and `usize::MAX` inclusive) and send it, causing the server to crash (integer overflow panic in debug builds, split_to out of bounds panic in release builds).\n\nThis was fixed in `vibeio-http` 0.3.2 by erroring on the chunk length if it exceeds `usize::MAX - 2` (using `checked_add()` instead of `+` operator), preventing integer overflow.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-06-06T12:00:00Z","modified":"2026-08-25T02:55:59Z","fixes":[{"ecosystem":"crates.io","package":"vibeio-http","fixed_in":["0.3.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"vibeio-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"vibeio-http","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.3.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"vibeio-http","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.3.2"}]}]}],"references":[{"url":"https://github.com/ferronweb/vibeio-http/blob/main/CHANGELOG.md#vibeio-http-032","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0181.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-fx4f-mhw4-qm7j"},{"url":"https://github.com/ferronweb/vibeio-http","tags":["package"]},{"url":"https://crates.io/crates/vibeio-http","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-fx4f-mhw4-qm7j","title":"vibeio-http has a DoS vulnerability in HTTP/1.x chunked encoding parser triggered by maliciously crafted chunk lengths","description":"When using the affected versions of the `vibeio-http` crate, an attacker could craft a malicious HTTP/1.x request with a large chunk length (between `usize::MAX - 1` and `usize::MAX` inclusive) and send it, causing the server to crash (integer overflow panic in debug builds, split_to out of bounds panic in release builds).\n\nThis was fixed in `vibeio-http` 0.3.2 by erroring on the chunk length if it exceeds `usize::MAX - 2` (using `checked_add()` instead of `+` operator), preventing integer overflow.","status":"published","published":"2026-08-24T22:05:02Z","modified":"2026-08-24T22:05:06Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:41:05.994358Z"}],"osv":[{"id":"GHSA-fx4f-mhw4-qm7j","title":"vibeio-http has a DoS vulnerability in HTTP/1.x chunked encoding parser triggered by maliciously crafted chunk lengths","description":"When using the affected versions of the `vibeio-http` crate, an attacker could craft a malicious HTTP/1.x request with a large chunk length (between `usize::MAX - 1` and `usize::MAX` inclusive) and send it, causing the server to crash (integer overflow panic in debug builds, split_to out of bounds panic in release builds).\n\nThis was fixed in `vibeio-http` 0.3.2 by erroring on the chunk length if it exceeds `usize::MAX - 2` (using `checked_add()` instead of `+` operator), preventing integer overflow.","status":"published","published":"2026-08-24T22:05:02Z","modified":"2026-08-25T02:55:59.491165582Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:47.119724Z"},{"id":"RUSTSEC-2026-0181","title":"DoS vulnerability in HTTP/1.x chunked encoding parser triggered by maliciously crafted chunk lengths","description":"When using the affected versions of the `vibeio-http` crate, an attacker could craft a malicious HTTP/1.x request with a large chunk length (between `usize::MAX - 1` and `usize::MAX` inclusive) and send it, causing the server to crash (integer overflow panic in debug builds, split_to out of bounds panic in release builds).\n\nThis was fixed in `vibeio-http` 0.3.2 by erroring on the chunk length if it exceeds `usize::MAX - 2` (using `checked_add()` instead of `+` operator), preventing integer overflow.","status":"published","published":"2026-06-06T12:00:00Z","modified":"2026-08-25T02:45:03.43590653Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}