GHSA-FX4F-MHW4-QM7J: Integer Overflow and Denial of Service in vibeio-http Chunked Parser
Vulnerability ID: GHSA-FX4F-MHW4-QM7J
CVSS Score: 7.5
Published: 2026-08-24
An integer overflow vulnerability exists in the HTTP/1.x chunked encoding parser of the vibeio-http library. The flaw is caused by unchecked integer addition when calculating the total buffer size required for processing parsed chunk lengths. By sending a maliciously crafted HTTP request containing an extremely large chunk size, an unauthenticated remote attacker can trigger a runtime panic, leading to complete denial of service.
TL;DR
An integer overflow vulnerability in vibeio-http version < 0.3.2 allows unauthenticated remote attackers to crash the server process by sending a crafted HTTP request with an excessively large chunk length, leading to a complete Denial of Service.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-190
- Attack Vector: Network
- CVSS v4.0 Score: 7.5
- Exploit Status: poc
- KEV Status: Not Listed
- Impact: Partial Availability Loss (Denial of Service)
Affected Systems
- vibeio-http
-
vibeio-http: < 0.3.2 (Fixed in:
0.3.2)
Exploit Details
- GitHub Advisory Database: Advisory writeup with proof-of-concept description and walkthrough.
Mitigation Strategies
- Upgrade the vibeio-http crate dependency to version 0.3.2 or newer.
- Implement temporary network or WAF boundary blocks on highly oversized chunked encoding sizes.
- Configure Rust panic handlers to catch-panic at the thread connection layer to avoid entire process exits if upgrades are delayed.
Remediation Steps:
- Open the Cargo.toml project configuration file.
- Locate the dependency entry for vibeio-http and update its version specification constraint to >= 0.3.2.
- Execute the terminal command: cargo update -p vibeio-http to apply the changes.
- Verify the Cargo.lock dependency resolution file specifies version 0.3.2 or later.
References
Read the full report for GHSA-FX4F-MHW4-QM7J on our website for more details including interactive diagrams and full exploit analysis.
