Executive brief
The vibeio-http library is used by web servers to parse incoming HTTP requests. An attacker can send a specially crafted HTTP request with an extremely large chunk length value, causing the server to crash immediately. This results in complete service unavailability, similar to other denial-of-service attacks.
Technical details
The vulnerability is an integer overflow (CWE-770: Allocation of Resources Without Limits) in the HTTP/1.x chunked encoding parser of vibeio-http. The vulnerable code uses the `+` operator instead of checked arithmetic when processing chunk lengths, allowing an attacker to provide a chunk length value near usize::MAX. In debug builds, this triggers a panic due to integer overflow; in release builds, it causes a panic in `split_to()` due to out-of-bounds access. The attack requires only network connectivity and no authentication or user interaction. The fix (0.3.2+) uses `checked_add()` to reject chunk lengths exceeding usize::MAX - 2, preventing the overflow before allocation occurs.
Affected products
- vibeio-http < 0.3.2
Timeline
- 2026-06-06: disclosed: Vulnerability reported
- 2026-06-13: advisory: RUSTSEC-2026-0181 issued
- 2026-08-24: patched: GitHub advisory GHSA-fx4f-mhw4-qm7j published; version 0.3.2 fixes the issue