-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the pipe_mode implementation overwriting existing pipe configuration flags. The Microsoft documentation shows PIPE_REJECT_REMOTE_CLIENTS is part of the same bitmask as pipe mode settings. The Tokio fix in pull request #5336 specifically addresses this by modifying how flags are preserved when setting pipe_mode. The ServerOptions::pipe_mode function was incorrectly resetting the entire flags field rather than just modifying the relevant pipe mode bits, making it the clear vulnerable function.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tokio | rust | >= 1.7.0, < 1.18.4 | 1.18.4 |
| tokio | rust | >= 1.19.0, < 1.20.3 | 1.20.3 |
| tokio | rust | >= 1.21.0, < 1.23.1 | 1.23.1 |