GHSA-FX4F-MHW4-QM7J: Integer Overflow and Denial of Service in vibeio-http Chunked Parser

The vulnerability affects the HTTP/1.x chunked transfer encoding parsing mechanism within the vibeio-http library. This library provides asynchronous HTTP/1.x server implementation routines. The parsing logic exposes a network-facing attack surface capable of receiving untrusted, malformed incoming payloads.

The root weakness is categorized as CWE-190 (Integer Overflow or Wraparound) and CWE-248 (Uncaught Exception). When handling incoming chunked transfer-encoded data streams, the library parses hexadecimal chunk lengths directly from the network. It attempts to compute the total size offset including framing delimiters without validation.

Because the operation is not bounds-checked, an attacker can specify a theoretical chunk size near the maximum limit of an unsigned pointer-sized integer (usize::MAX). Depending on the compilation profile of the host executable, this causes an immediate integer overflow panic or an out-of-bounds slice partition panic, crash-terminating the server worker or process.

Under the HTTP/1.x standard defined in RFC 9112 Section 7.1, chunked payloads consist of hexadecimal size definitions followed by carriage return line feed (CRLF) delimiters and chunk payload bytes. The vibeio-http parser reads the hex size string from the socket and converts it into a usize value representing the expected length.

To ensure the active internal memory buffer contains the complete chunk including its structural payload and the terminating CRLF boundary (\r\n), the parser evaluates whether the current buffer meets or exceeds the required length. This validation is calculated through raw addition:

let total_required = chunk_len + 2;

When a malicious client sends a chunk size of usize::MAX - 1 or usize::MAX, the behavior splits based on the Rust compilation target profile. In a standard Debug build, Rust includes overflow checks on basic math operators by default. This causes the addition operator + to panic immediately upon overflow. In a standard Release build, explicit runtime overflow validation is disabled. The value wraps around according to modular arithmetic rules, evaluating usize::MAX - 1 + 2 to 0. Consequently, subsequent length comparisons pass, causing the parser to invoke buffer division operations like buffer.split_to(chunk_len). Because chunk_len is enormously large and exceeds the actual buffer capacity, the slicing logic triggers an out-of-bounds panic.

The following diagram outlines the structural path that causes the panic behaviors across Debug and Release profiles:

Prior to version 0.3.2, the vulnerable processing logic handled the chunked calculation directly without checking boundaries:

// Vulnerable code implementation
pub fn parse_chunk_header(buf: &mut BytesMut) -> Result<Option<usize>, ParseError> {
    if let Some(chunk_len) = read_hex_size(buf)? {
        // Vulnerable: raw addition can overflow usize capacity
        let total_required = chunk_len + 2; 
        
        if buf.remaining() < total_required {
            return Ok(None); // Wait for more data
        }
        
        return Ok(Some(chunk_len));
    }
    Ok(None)
}

The remediated code implements defensive checked addition via Rust's checked_add api, ensuring calculations do not wrap or panic:

// Patched code implementation in v0.3.2
pub fn parse_chunk_header(buf: &mut BytesMut) -> Result<Option<usize>, ParseError> {
    if let Some(chunk_len) = read_hex_size(buf)? {
        // Patched: safe checked addition detects overflow conditions
        let total_required = chunk_len.checked_add(2)
            .ok_or(ParseError::InvalidChunkSize)?;
            
        if chunk_len > usize::MAX - 2 {
            return Err(ParseError::InvalidChunkSize);
        }
 
        if buf.remaining() < total_required {
            return Ok(None);
        }
 
        return Ok(Some(chunk_len));
    }
    Ok(None)
}

To exploit this vulnerability, an attacker must have network connectivity to an active TCP port handled by an application running vibeio-http prior to version 0.3.2. No credentials or prior authentication states are required.

The attacker initiates a standard TCP handshake and sends a crafted POST or PUT request specifying chunked encoding. The body of the request must begin with a malformed hexadecimal chunk length indicating an overflow size:

POST /upload HTTP/1.1
Host: vulnerable-server.local
Transfer-Encoding: chunked
Content-Type: application/octet-stream
 
fffffffffffffffe

Upon processing the HTTP request header and parsing the chunk length string fffffffffffffffe (representing usize::MAX - 1 on 64-bit systems), the server execution thread will execute the vulnerable addition. Because of the resulting panic, the corresponding connection thread terminates immediately. If the server process is configured with panic = "abort" or runs single-threaded loop systems, the entire process terminates, causing a total Denial of Service.

The concrete security impact is limited to availability. Due to the strict memory safety protections of the Rust language, out-of-bounds slicing actions and integer overflows do not generate arbitrary read or write primitives in memory. Therefore, there is no threat of information disclosure or remote code execution.

However, the availability impact is severe. Because the library's internal structures do not isolate standard parsing exceptions inside a safe connection thread pool boundary, a single malformed packet can terminate the entire server application. If continuous crash-loop scenarios occur, this will deplete system resources and disrupt operations.

This vulnerability does not require complex routing configurations, specialized headers, or user interactions to execute, granting it a high impact score on systems requiring continuous network uptime.

The definitive remediation for this vulnerability is upgrading the vibeio-http crate to version 0.3.2 or later. This release mitigates the flaw by implementing checked math structures that cleanly return parsing error structures rather than throwing unhandled thread panics.

# Upgrade dependency using Cargo
cargo update -p vibeio-http

If instant library upgrades are not feasible due to deployment or qualification cycles, administrators should apply Web Application Firewall (WAF) filter policies. Configure the proxy layer to inspect incoming requests containing the header Transfer-Encoding: chunked and reject any request with an initial chunk size hexadecimal string indicating more than a predefined application boundary (for instance, rejecting chunk sizes larger than 0x10000000 / 256MB).