RUSTSEC-2026-0181None▾ SunlitDoS vulnerability in HTTP/1.x chunked encoding parser triggered by maliciously crafted chunk lengths
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
When using the affected versions of the vibeio-http crate, an attacker could craft a malicious HTTP/1.x request with a large chunk length (between usize::MAX - 1 and usize::MAX inclusive) and send it, causing the server to crash (integer overflow panic in debug builds, split_to out of bounds panic in release builds).
This was fixed in vibeio-http 0.3.2 by erroring on the chunk length if it exceeds usize::MAX - 2 (using checked_add() instead of + operator), preventing integer overflow.
vibeio-http >= 0.0.0-0, < 0.3.2Upgrade to a patched release:
vibeio-http 0.3.2Connected by shared product, vendor, weakness, or advisory.