https://vulnerability.circl.lu/sightings/feed 2026-08-30T09:18:48.202462+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/86f14b5f-ba43-463b-b059-8d330302e910/export 2026-08-30T09:18:48.215821+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "86f14b5f-ba43-463b-b059-8d330302e910", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-FX4F-MHW4-QM7J", "type": "seen", "source": "https://gist.github.com/alon710/653b6e9d66f28c30c9e1c761be426c54", "content": "# GHSA-FX4F-MHW4-QM7J: GHSA-FX4F-MHW4-QM7J: Integer Overflow and Denial of Service in vibeio-http Chunked Parser\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-24\n> **Full Report:** https://cvereports.com/reports/GHSA-FX4F-MHW4-QM7J\n\n## Summary\nAn integer overflow vulnerability exists in the HTTP/1.x chunked encoding parser of the vibeio-http library. The flaw is caused by unchecked integer addition when calculating the total buffer size required for processing parsed chunk lengths. By sending a maliciously crafted HTTP request containing an extremely large chunk size, an unauthenticated remote attacker can trigger a runtime panic, leading to complete denial of service.\n\n## TL;DR\nAn integer overflow vulnerability in vibeio-http version < 0.3.2 allows unauthenticated remote attackers to crash the server process by sending a crafted HTTP request with an excessively large chunk length, leading to a complete Denial of Service.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-190\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 7.5\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n- **Impact**: Partial Availability Loss (Denial of Service)\n\n## Affected Systems\n\n- vibeio-http\n- **vibeio-http**: < 0.3.2 (Fixed in: `0.3.2`)\n\n## Mitigation\n\n- Upgrade the vibeio-http crate dependency to version 0.3.2 or newer.\n- Implement temporary network or WAF boundary blocks on highly oversized chunked encoding sizes.\n- Configure Rust panic handlers to catch-panic at the thread connection layer to avoid entire process exits if upgrades are delayed.\n\n**Remediation Steps:**\n1. Open the Cargo.toml project configuration file.\n2. Locate the dependency entry for vibeio-http and update its version specification constraint to >= 0.3.2.\n3. Execute the terminal command: cargo update -p vibeio-http to apply the changes.\n4. Verify the Cargo.lock dependency resolution file specifies version 0.3.2 or later.\n\n## References\n\n- [GitHub Advisory Entry](https://github.com/advisories/GHSA-FX4F-MHW4-QM7J)\n- [RustSec Advisory Entry](https://rustsec.org/advisories/RUSTSEC-2026-0181.html)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-FX4F-MHW4-QM7J) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-25T09:31:42.923018Z"} 2026-08-25T09:31:42.923018+00:00