Read the docs
TI-2023-08715 Aliases CVE-2023-22466GHSA-7rrj-xr53-82p7

Tokio's reject_remote_clients configuration may get dropped when creating a Windows named pipe

Priority LOW 25CWE-665Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Tokio is a runtime for writing applications with Rust. Starting with version 1.7.0 and prior to versions 1.18.4, 1.20.3, and 1.23.1, when configuring a Windows named pipe server, setting `pipe_mode` will reset `reject_remote_clients` to `false`. If the application has previously configured `reject_remote_clients` to `true`, this effectively undoes the configuration. Remote clients may only access the named pipe if the named pipe's associated path is accessible via a publicly shared folder (SMB). Versions 1.23.1, 1.20.3, and 1.18.4 have been patched. The fix will also be present in all releases starting from version 1.24.0. Named pipes were introduced to Tokio in version 1.7.0, so releases older than 1.7.0 are not affected. As a workaround, ensure that `pipe_mode` is set first after initializing a `ServerOptions`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00612 49th percentileScored 2026-11-07
Fix Fixed tokio (tokio-rs): 1.18.4, 1.20.3, 1.23.1tokio (crates.io): 1.18.4, 1.20.3, 1.23.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
tokio-rstokio1.7.0 to before 1.18.4; 1.19.0 to before 1.20.3; 1.21.0 to before 1.23.11.18.4, 1.20.3, 1.23.1Patch availableCNA
—tokio (crates.io)1.7.0 to before 1.18.41.18.4Patch availableGHSA-7rrj-xr53-82p7
—tokio (crates.io)1.19.0 to before 1.20.31.20.3Patch availableGHSA-7rrj-xr53-82p7
—tokio (crates.io)1.21.0 to before 1.23.11.23.1Patch availableGHSA-7rrj-xr53-82p7
  • tokio Vendortokio-rs Affected 1.7.0 to before 1.18.4; 1.19.0 to before 1.20.3; 1.21.0 to before 1.23.1 Fixed in 1.18.4, 1.20.3, 1.23.1 Patch available CNA
  • tokio (crates.io) Vendor— Affected 1.7.0 to before 1.18.4 Fixed in 1.18.4 Patch available GHSA-7rrj-xr53-82p7
  • tokio (crates.io) Vendor— Affected 1.19.0 to before 1.20.3 Fixed in 1.20.3 Patch available GHSA-7rrj-xr53-82p7
  • tokio (crates.io) Vendor— Affected 1.21.0 to before 1.23.1 Fixed in 1.23.1 Patch available GHSA-7rrj-xr53-82p7

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:tokio:tokio:*:*:*:*:*:rust:*:*1.7.0 to before 1.18.4; 1.19.0 to before 1.20.3; 1.21.0 to before 1.23.1VulnerableTokio
  • cpe:2.3:a:tokio:tokio:*:*:*:*:*:rust:*:* Versions 1.7.0 to before 1.18.4; 1.19.0 to before 1.20.3; 1.21.0 to before 1.23.1 Vulnerable ·Tokio

Remediation

  • Fix · CNA tokio (tokio-rs) Fixed in 1.18.4, 1.20.3, 1.23.1
  • Fix · GHSA-7rrj-xr53-82p7 tokio (crates.io) Fixed in 1.18.4 Advisory →
  • Fix · GHSA-7rrj-xr53-82p7 tokio (crates.io) Fixed in 1.20.3 Advisory →
  • Fix · GHSA-7rrj-xr53-82p7 tokio (crates.io) Fixed in 1.23.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-22466
  2. 2026-10-03 Alias added: GHSA-7rrj-xr53-82p7

References

Patch 1

Advisory 4

Other 2

  • TI-2024-18146 Mio's tokens for named pipes may be delivered after deregistration CVSS 3.1CRITICAL 9.1
  • TI-2026-20650 Bytes is vulnerable to integer overflow in BytesMut::reserve CVSS 4.0MEDIUM 5.5
  • TI-2022-02967 DoS in axum-core due to missing request size limit CVSS 3.1HIGH 7.5
  • TI-2026-79968 Race condition in Tokio time Interval can cause use-after-free CVSS 4.0MEDIUM 5.8
  • TI-2025-34841 slab allows out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check CVSS 4.0MEDIUM 5.1
  • TI-2025-35976 Tracing logging user input may result in poisoning logs with ANSI escape sequences CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences