Vulnerabilities

Some older versions of Ferron may contain security vulnerabilities. It’s recommended to keep Ferron up-to-date.

Fixed in Ferron 3.0.0-rc.7

An unauthenticated HTTP/3 client could send a single large SETTINGS frame containing many distinct setting identifiers, forcing the server to perform quadratic CPU work synchronously in the connection driver task, possibly exhausting CPU and denying service. (CWE-407, CWE-770; GHSA-g26q-6rqx-4wr7; zincio-http ≤ 0.4.9; introduced in Ferron 3.0.0-beta.9)
An unauthenticated HTTP/2 client could repeatedly send a valid HEADERS frame and immediately cancel it with RST_STREAM (“Rapid Reset”), bypassing the reset throttles and causing unbounded CPU consumption and task-spawn exhaustion. (CWE-770; GHSA-chmh-xfr6-94xp; zincio-http ≤ 0.4.9; introduced in Ferron 3.0.0-beta.9)

An attacker using the forward proxy could bypass the deny_ips denylist and DNS enforcement: DNS resolution and ACL errors were passed through instead of being rejected, allowing requests to internal-only destinations (SSRF / access-control bypass). (CWE-636, CWE-918; GHSA-3vvm-v3qp-7gmg; fproxy module; introduced in Ferron 3.0.0-beta.1)
The forward proxy forwarded hop-by-hop headers (Proxy-Authorization, Proxy-Authenticate, Keep-Alive, Transfer-Encoding, TE, Trailer, and headers nominated by Connection) to origin servers, disclosing the client’s proxy credentials to whatever host it asked the proxy to fetch and creating a request-smuggling hazard. (CWE-200; GHSA-jhxh-2fvx-85c3; fproxy module; introduced in Ferron 3.0.0-beta.1)
An attacker could bypass location-based access controls for static files using an encoded slash: a request for /private%2Fsecret did not match location /private, but the path was URL-decoded before the filesystem lookup and the file was served anyway. (CWE-22, CWE-436; GHSA-65v2-g5fc-7r73; introduced in Ferron 3.0.0-beta.1)
The Admin API’s POST /reload endpoint was authorized by the reload_get flag instead of reload, so a deployment configured with reload false but reload_get true still accepted and executed configuration reloads. (CWE-863; GHSA-q448-r9rw-98p6; introduced in Ferron 3.0.0-rc.1)

auth_to failed open when combined with proxy: the rejection from the authentication backend was discarded, so a denied request still reached the proxied backend, exposing protected applications to unauthenticated access, including state-changing requests. (CWE-252, CWE-863; GHSA-vp46-fx86-chgc; fauth module; introduced in Ferron 3.0.0-beta.2)

An attacker could craft a cookie value containing &cookie: to collide with another user’s cache key, when HTTP caching is enabled. (CWE-74; introduced in Ferron 3.0.0-alpha.1)

An attacker could craft a malicious HTTP/1.x request with a large chunk length (between usize::MAX - 1 and usize::MAX inclusive) and send it, causing the server to crash (integer overflow panic in debug builds, split_to out of bounds panic in release builds). (RUSTSEC-2026-0181; introduced in Ferron 3.0.0-alpha.1)

An attacker could send many large enough PROXY v2 headers, if the PROXY protocol is enabled, possibly leading to memory exhaustion. (CWE-789; introduced in Ferron 2.0.0-beta.10)

An attacker could crash the server by sending QUIC transport parameters containing invalid values. (CVE-2026-31812; introduced in Ferron 1.1.0)

An attacker could send a large enough PROXY v2 header to crash the web server, if the PROXY protocol is enabled. This was caused by an out-of-bounds memory access attempt. (CWE-119; introduced in Ferron 2.0.0-beta.10)
An attacker could perform a path traversal vulnerability, if URL sanitizer was disabled and path canonicalization failed. (CWE-22; introduced in Ferron 2.3.0)
An attacker could sent a request with a “Proxy” header to a web server (with CGI, FastCGI or SCGI enabled) to perform an “httpoxy” attack (CWE-20)

An attacker could send a lot of concurrent requests that have a header defining accepted compression algorithm to be Brotli (for example using ferrbench -c 20000 -d 1h -t 12 -H "Cache-Control: no-cache" -H "Accept-Encoding: br" -h https://victim.example --http2 command) to cause the server to consume too much memory. (CWE-400)

An attacker could request a resource with a URL that would be replaced with a sanitized one, to possibly bypass security restrictions, if they’re configured in location configurations. (CWE-20; introduced in Ferron 1.0.0-beta2)

An attacker could connect to the server acting as a reverse proxy via HTTP/3 to cause a Rust panic in the server, and in effect crash the server. (CWE-248; fauth module; introduced in Ferron 1.1.0)
An attacker could connect to the server acting as a reverse proxy via HTTP/3 to cause a Rust panic in the server, and in effect crash the server. (CWE-248; rproxy module; introduced in Ferron 1.1.0)

An attacker could connect to the server that handles request bodies via HTTP/3 and send a request body to make the server stop accepting HTTP requests due to the server entering an infinite loop after the client finished sending the request body. (CWE-835; introduced in Ferron 1.1.0)

An attacker could send a lot of concurrent requests that have a header defining accepted compression algorithm to be Brotli (for example using ferrbench -c 100 -d 1h -t 12 -H "Accept-Encoding: br" -h https://victim.example --http2 command) to make the server stop accepting HTTP requests, due to inefficient compression process. (CWE-400).

An attacker could send a request body smaller than the specified length, wait for a long time, and repeat with many connections to possibly exhaust the server resources. This is because the server doesn’t implement server timeouts. (CWE-400)

An attacker could send a partial request body to the server, and then other parts of partial request body to possibly exhaust the server resources. This is because the server only sends first part of request body into web application. (CWE-770; cgi module; introduced in Project Karpacz 0.6.0).
An attacker could send a partial request body to the server, and then other parts of partial request body to possibly exhaust the server resources. This is because the server only sends first part of request body into web application. (CWE-770; fcgi module; introduced in Project Karpacz 0.6.0).
An attacker could send a partial request body to the server, and then other parts of partial request body to possibly exhaust the server resources. This is because the server only sends first part of request body into web application. (CWE-770; scgi module; introduced in Project Karpacz 0.6.0).

An attacker could add double slashes to the request URL before “cgi-bin” to bypass the CGI handler and possibly leak the CGI scripts’ source code. (CWE-22; cgi module; introduced in Project Karpacz 0.5.0).

An attacker could send a lot of concurrent requests (100 concurrent requests is enough) to make the server stop accepting HTTP requests. (CWE-410; rproxy module; introduced in Project Karpacz 0.2.0).