CVE catalog

CVE-2022-31394

rust-hyper: CVE-2022-31394

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
1.08% · Oct 22, 2026

Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform HTTP2 attacks.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrust-hypersid1.11.1-1fixed
Debianrust-hyperforky1.11.1-1fixed
Debianrust-hypertrixie1.5.2-1fixed
Debianrust-hyperbookworm0.14.19-1fixed
Susegstreamer-plugins-rslinux enterprise module for desktop applications 15 sp50.8.2-150400.3.3.1fixed
Susegstreamer-plugins-rslinux enterprise real time 15 sp40.8.2-150400.3.3.1fixed
Suserustuplinux enterprise module for development tools 15 sp41.26.0~0-150400.3.7.1fixed
Suserustuplinux enterprise module for development tools 15 sp51.26.0~0-150400.3.7.1fixed
Opensuserustupleap 15.41.26.0~0-150400.3.7.1fixed
Opensuserustupleap 15.51.26.0~0-150400.3.7.1fixed
Opensuserustuptumbleweed1.25.2~0-2.1fixed
Susesccachelinux enterprise module for development tools 15 sp50.4.1~18-150300.7.12.1fixed
Susesccachelinux enterprise high performance computing 15 sp3-espos0.4.1~18-150300.7.12.1fixed
Susesccachelinux enterprise high performance computing 15 sp3-ltss0.4.1~18-150300.7.12.1fixed
Susesccachelinux enterprise real time 15 sp30.4.1~18-150300.7.12.1fixed
Susesccachelinux enterprise server 15 sp3-ltss0.4.1~18-150300.7.12.1fixed
Susesccachelinux enterprise server for sap applications 15 sp30.4.1~18-150300.7.12.1fixed
Susesccacheenterprise storage 7.10.4.1~18-150300.7.12.1fixed
Opensusepijultumbleweed1.0.0~beta.4-1.1fixed
Opensusewasm-packtumbleweed0.11.0~0-1.1fixed
Opensusesccachetumbleweed0.4.0pre.7~0-2.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrust-hypersourcesid0.14.19-1not yet assignedNot reportedNot reported
Debianrust-hypersourceforky0.14.19-1not yet assignedNot reportedNot reported
Debianrust-hypersourcetrixie0.14.19-1not yet assignedNot reportedNot reported
Debianrust-hypersourcebookworm0.14.19-1not yet assignedNot reportedNot reported
Susegstreamer-plugins-rsrpmlinux enterprise module for desktop applications 15 sp50.8.2-150400.3.3.1Not reportedSUSE-SU-2024:0090-1Not reported
Susegstreamer-plugins-rsrpmlinux enterprise real time 15 sp40.8.2-150400.3.3.1Not reportedSUSE-SU-2024:0090-1Not reported
Suserustuprpmlinux enterprise module for development tools 15 sp41.26.0~0-150400.3.7.1Not reportedSUSE-SU-2023:2603-1Not reported
Suserustuprpmlinux enterprise module for development tools 15 sp51.26.0~0-150400.3.7.1Not reportedSUSE-SU-2023:2603-1Not reported
Opensuserustuprpmleap 15.41.26.0~0-150400.3.7.1Not reportedSUSE-SU-2023:2603-1Not reported
Opensuserustuprpmleap 15.51.26.0~0-150400.3.7.1Not reportedSUSE-SU-2023:2603-1Not reported
Opensuserustuprpmtumbleweed1.25.2~0-2.1Not reportedOPENSUSE-SU-2024:12727-1Not reported
Susesccacherpmlinux enterprise module for development tools 15 sp50.4.1~18-150300.7.12.1Not reportedSUSE-SU-2023:2637-1Not reported
Susesccacherpmlinux enterprise high performance computing 15 sp3-espos0.4.1~18-150300.7.12.1Not reportedSUSE-SU-2023:2637-1Not reported
Susesccacherpmlinux enterprise high performance computing 15 sp3-ltss0.4.1~18-150300.7.12.1Not reportedSUSE-SU-2023:2637-1Not reported
Susesccacherpmlinux enterprise real time 15 sp30.4.1~18-150300.7.12.1Not reportedSUSE-SU-2023:2637-1Not reported
Susesccacherpmlinux enterprise server 15 sp3-ltss0.4.1~18-150300.7.12.1Not reportedSUSE-SU-2023:2637-1Not reported
Susesccacherpmlinux enterprise server for sap applications 15 sp30.4.1~18-150300.7.12.1Not reportedSUSE-SU-2023:2637-1Not reported
Susesccacherpmenterprise storage 7.10.4.1~18-150300.7.12.1Not reportedSUSE-SU-2023:2637-1Not reported
Opensusepijulrpmtumbleweed1.0.0~beta.4-1.1Not reportedOPENSUSE-SU-2024:12764-1Not reported
Opensusewasm-packrpmtumbleweed0.11.0~0-1.1Not reportedOPENSUSE-SU-2024:12807-1Not reported
Opensusesccacherpmtumbleweed0.4.0pre.7~0-2.1Not reportedOPENSUSE-SU-2024:12728-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [pijul-bash-completion]Unknown

    Source package: [pijul]

    Details (1)

    • 1.0.0~beta.9-1.7 · noarch · tumbleweed

      Unknown · Fixed: 1.0.0~beta.4-1.1

      Version impact unknown

      dsa · pijul · opensuse · tumbleweed

  • [pijul-fish-completion]Unknown

    Source package: [pijul]

    Details (1)

    • 1.0.0~beta.9-1.7 · noarch · tumbleweed

      Unknown · Fixed: 1.0.0~beta.4-1.1

      Version impact unknown

      dsa · pijul · opensuse · tumbleweed

  • [pijul-zsh-completion]Unknown

    Source package: [pijul]

    Details (1)

    • 1.0.0~beta.9-1.7 · noarch · tumbleweed

      Unknown · Fixed: 1.0.0~beta.4-1.1

      Version impact unknown

      dsa · pijul · opensuse · tumbleweed

  • [pijul]Fixed

    Source package: [pijul]

    Details (1)

    • 1.0.0~beta.9-1.7 · x86_64 · tumbleweed

      Fixed · Fixed: 1.0.0~beta.4-1.1

      dsa · pijul · opensuse · tumbleweed

  • [rustup]Fixed

    Source package: [rustup]

    Details (1)

    • 1.29.0~0-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 1.25.2~0-2.1

      dsa · rustup · opensuse · tumbleweed

  • [sccache]Fixed

    Source package: [sccache]

    Details (1)

    • 0.17.0~1-2.1 · x86_64 · tumbleweed

      Fixed · Fixed: 0.4.0pre.7~0-2.1

      dsa · sccache · opensuse · tumbleweed

  • [wasm-pack]Fixed

    Source package: [wasm-pack]

    Details (1)

    • 0.13.1-1.6 · x86_64 · tumbleweed

      Fixed · Fixed: 0.11.0~0-1.1

      dsa · wasm-pack · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [librust-hyper-dev]Fixed

    Source package: [rust-hyper]

    Details (2)

    • 0.14.19-1 · amd64 · bookworm

      Fixed · Fixed: 0.14.19-1

      dsa · rust-hyper · debian · bookworm

    • 0.14.19-1 · arm64 · bookworm

      Fixed · Fixed: 0.14.19-1

      dsa · rust-hyper · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]