{"id":"CVE-2023-22466","aliases":["RUSTSEC-2023-0001","GHSA-7rrj-xr53-82p7"],"title":"reject_remote_clients Configuration corruption","summary":"reject_remote_clients Configuration corruption","severity":"none","vendor":"tokio","product":"tokio","ecosystem":"rust","affected":["tokio >= 1.21.0, < 1.23.1"],"patched":["tokio 1.23.1"],"published":"2023-01-04","updated":"2026-10-12","sourceUpdated":"2026-10-12T18:00:06.115643924Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2023-0001","references":[{"url":"https://crates.io/crates/tokio"},{"url":"https://rustsec.org/advisories/RUSTSEC-2023-0001.html"},{"url":"https://github.com/tokio-rs/tokio/pull/5336"},{"url":"https://github.com/tokio-rs/tokio/pull/5336"},{"url":"https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createnamedpipea#pipe_reject_remote_clients"}],"tags":["osv","rust"],"epss":0.0059,"epssPercentile":0.47472,"ingestedAt":"2026-10-13T11:45:30.160Z","slug":"CVE-2023-22466","body":"## Overview\n\nOn Windows, configuring a named pipe server with [pipe_mode] will force [ServerOptions]::[reject_remote_clients] as `false`.\n\nThis drops any intended explicit configuration for the [reject_remote_clients] that may have been set as `true` previously.\n\nThe default setting of [reject_remote_clients] is normally `true` meaning the default is also overridden as `false`.\n\n## Workarounds\n\nEnsure that [pipe_mode] is set first after initializing a [ServerOptions]. For example:\n\n```rust\nlet mut opts = ServerOptions::new();\nopts.pipe_mode(PipeMode::Message);\nopts.reject_remote_clients(true);\n```\n\n[ServerOptions]: https://docs.rs/tokio/latest/tokio/net/windows/named_pipe/struct.ServerOptions.html\n[pipe_mode]: https://docs.rs/tokio/latest/tokio/net/windows/named_pipe/struct.ServerOptions.html#method.pipe_mode\n[reject_remote_clients]: https://docs.rs/tokio/latest/tokio/net/windows/named_pipe/struct.ServerOptions.html#method.reject_remote_clients\n\n## Affected packages\n\n- `tokio >= 1.21.0, < 1.23.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `tokio 1.23.1`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}