---
id: CVE-2023-22466
aliases:
  - RUSTSEC-2023-0001
  - GHSA-7rrj-xr53-82p7
title: reject_remote_clients Configuration corruption
summary: reject_remote_clients Configuration corruption
severity: none
vendor: tokio
product: tokio
ecosystem: rust
affected:
  - 'tokio >= 1.21.0, < 1.23.1'
patched:
  - tokio 1.23.1
published: '2023-01-04'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T18:00:06.115643924Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2023-0001'
references:
  - url: 'https://crates.io/crates/tokio'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2023-0001.html'
  - url: 'https://github.com/tokio-rs/tokio/pull/5336'
  - url: 'https://github.com/tokio-rs/tokio/pull/5336'
  - url: >-
      https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createnamedpipea#pipe_reject_remote_clients
tags:
  - osv
  - rust
epss: 0.0059
epssPercentile: 0.47472
ingestedAt: '2026-10-13T11:45:30.160Z'
---

## Overview

On Windows, configuring a named pipe server with [pipe_mode] will force [ServerOptions]::[reject_remote_clients] as `false`.

This drops any intended explicit configuration for the [reject_remote_clients] that may have been set as `true` previously.

The default setting of [reject_remote_clients] is normally `true` meaning the default is also overridden as `false`.

## Workarounds

Ensure that [pipe_mode] is set first after initializing a [ServerOptions]. For example:

```rust
let mut opts = ServerOptions::new();
opts.pipe_mode(PipeMode::Message);
opts.reject_remote_clients(true);
```

[ServerOptions]: https://docs.rs/tokio/latest/tokio/net/windows/named_pipe/struct.ServerOptions.html
[pipe_mode]: https://docs.rs/tokio/latest/tokio/net/windows/named_pipe/struct.ServerOptions.html#method.pipe_mode
[reject_remote_clients]: https://docs.rs/tokio/latest/tokio/net/windows/named_pipe/struct.ServerOptions.html#method.reject_remote_clients

## Affected packages

- `tokio >= 1.21.0, < 1.23.1`

## Remediation

Upgrade to a patched release:

- `tokio 1.23.1`