CVE-2022-31394

Name of the Vulnerable Software and Affected Versions Hyper versions prior to 0.14.19

Description The issue is related to the HTTP library for Rust Hyper, which is associated with unbounded resource allocation. This can be exploited by a remote attacker to cause a denial of service. The vulnerability is also related to the lack of customization for the max header list size method in the H2 third-party software, allowing attackers to perform HTTP2 attacks.

Recommendations For versions prior to 0.14.19, update to version 0.14.19 or later to resolve the issue. As a temporary workaround, consider restricting access to the H2 third-party software to minimize the risk of exploitation. Avoid using the max header list size method in affected API endpoints until the issue is resolved.