---
id: CVE-2022-39294
aliases:
  - RUSTSEC-2022-0066
  - GHSA-9398-5ghf-7pr6
title: Denial of Service from unchecked request length
summary: Denial of Service from unchecked request length
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: conduit-hyper
product: conduit-hyper
ecosystem: rust
affected:
  - 'conduit-hyper >= 0.2.0-alpha.3, < 0.4.2'
patched:
  - conduit-hyper 0.4.2
published: '2022-10-30'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T18:00:05.116359517Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2022-0066'
references:
  - url: 'https://crates.io/crates/conduit-hyper'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2022-0066.html'
  - url: >-
      https://github.com/conduit-rust/conduit-hyper/commit/4d225a53206505d39438ec6694e15f49c038baff
tags:
  - osv
  - rust
epss: 0.00749
epssPercentile: 0.54709
ingestedAt: '2026-10-13T11:45:30.157Z'
---

## Overview

Prior to version 0.4.2, `conduit-hyper` did not check any limit on a request's
length before calling `hyper::body::to_bytes`. An attacker could send a
malicious request with an abnormally large `Content-Length`, which could lead
to a panic if memory allocation failed for that request.

In version 0.4.2, `conduit-hyper` sets an internal limit of 128 MiB per
request, otherwise returning status 400 ("Bad Request").

## Affected packages

- `conduit-hyper >= 0.2.0-alpha.3, < 0.4.2`

## Remediation

Upgrade to a patched release:

- `conduit-hyper 0.4.2`