{
  "cveId": "CVE-2023-22466",
  "url": "https://patchblox.com/security/cve/CVE-2023-22466",
  "summary": "CVE-2023-22466 is fixed in rust-tokio on 1 platform, first by DEBIAN-CVE-2023-22466, released January 4, 2023. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "rust-tokio: Tokio is a runtime for writing applications with Rust",
  "description": "Tokio is a runtime for writing applications with Rust. Starting with version 1.7.0 and prior to versions 1.18.4, 1.20.3, and 1.23.1, when configuring a Windows named pipe server, setting \u0060pipe_mode\u0060 will reset \u0060reject_remote_clients\u0060 to \u0060false\u0060. If the application has previously configured \u0060reject_remote_clients\u0060 to \u0060true\u0060, this effectively undoes the configuration. Remote clients may only access the named pipe if the named pipe\u0027s associated path is accessible via a publicly shared folder (SMB). Versions 1.23.1, 1.20.3, and 1.18.4 have been patched. The fix will also be present in all releases starting from version 1.24.0. Named pipes were introduced to Tokio in version 1.7.0, so releases older than 1.7.0 are not affected. As a workaround, ensure that \u0060pipe_mode\u0060 is set first after initializing a \u0060ServerOptions\u0060.",
  "published": "2023-01-04T22:15:09Z",
  "severity": "medium",
  "cvss": 5.4,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "epss": 0.00612,
  "epssPercentile": 0.49612,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "rust-tokio",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "1.24.2-1",
      "fix": "DEBIAN-CVE-2023-22466",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-22466",
      "released": "2023-01-04T22:15:09Z"
    },
    {
      "platform": "linux",
      "product": "rust-tokio",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1.24.2-1",
      "fix": "DEBIAN-CVE-2023-22466",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-22466",
      "released": "2023-01-04T22:15:09Z"
    },
    {
      "platform": "linux",
      "product": "rust-tokio",
      "release": "Debian 14",
      "fixedVersion": "1.24.2-1",
      "fix": "DEBIAN-CVE-2023-22466",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-22466",
      "released": "2023-01-04T22:15:09Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T19:38:12Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}