---
id: GHSA-fx4f-mhw4-qm7j
title: >-
  vibeio-http has a DoS vulnerability in HTTP/1.x chunked encoding parser
  triggered by maliciously crafted chunk lengths
summary: >-
  vibeio-http has a DoS vulnerability in HTTP/1.x chunked encoding parser
  triggered by maliciously crafted chunk lengths
severity: medium
cwe:
  - CWE-770
vendor: vibeio-http
product: vibeio-http
ecosystem: rust
affected:
  - vibeio-http < 0.3.2
patched:
  - vibeio-http 0.3.2
published: '2026-08-24'
updated: '2026-08-24'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-fx4f-mhw4-qm7j'
references:
  - url: >-
      https://github.com/ferronweb/vibeio-http/blob/main/CHANGELOG.md#vibeio-http-032
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0181.html'
  - url: 'https://github.com/advisories/GHSA-fx4f-mhw4-qm7j'
tags:
  - ghsa
  - rust
ingestedAt: '2026-08-24T22:12:10.917Z'
---

## Overview

When using the affected versions of the `vibeio-http` crate, an attacker could craft a malicious HTTP/1.x request with a large chunk length (between `usize::MAX - 1` and `usize::MAX` inclusive) and send it, causing the server to crash (integer overflow panic in debug builds, split_to out of bounds panic in release builds).

This was fixed in `vibeio-http` 0.3.2 by erroring on the chunk length if it exceeds `usize::MAX - 2` (using `checked_add()` instead of `+` operator), preventing integer overflow.

## Affected packages

- `vibeio-http < 0.3.2`

## Remediation

Upgrade to a patched release:

- `vibeio-http 0.3.2`