Stack Overflow in Axum with Mutual Tls

When an Axum service is protected with Mutual TLS (mTLS), client certificates are required to establish the TLS connection. If the service also exposes endpoints that trigger heavy or unbounded processing (for example, large body parsing, deserialization, or expensive request transformations), an authenticated client can intentionally amplify resource usage by sending many concurrent or large requests. This authenticated channel can shift a resource exhaustion issue from an anonymous attack surface to a controlled one, because mTLS ensures each request is associated with a valid client certificate. In such cases, Stack Overflow can manifest as prolonged blocking on body extraction, certificate verification, or application-level processing, making the service less available to legitimate mTLS-authenticated users.

middleBrick scans this authenticated attack surface during a standard 5–15 second check. Even without credentials, some Axum services inadvertently allow unauthenticated TLS negotiation or present timing differences that can be probed. The scanner’s unauthenticated checks include inputs that can stress parsing and routing logic, and findings may highlight missing rate controls around connection and body handling. When combined with mTLS, a misconfigured or permissive certificate policy might also broaden the set of clients able to trigger the overload, increasing the impact compared to a purely open endpoint.

Consider an Axum route that eagerly deserializes a large JSON payload before any authorization check:

use axum::{routing::post, Router};
use serde::Deserialize;

#[derive(Deserialize)]
struct LargePayload {
    data: Vec,
}

async fn handler(payload: axum::Json) -> &'static str {
    "ok"
}

let app = Router::new().route("/upload", post(handler));

An mTLS-enabled deployment will still perform TLS handshakes and present client certificates, but if no limits are placed on request size or concurrent body parsing, a Stack Overflow–style disruption can occur via memory pressure or thread exhaustion. The presence of mTLS changes the threat model from anonymous clients to authenticated ones, which means findings tied to authentication, BOLA/IDOR, and Rate Limiting become more significant when mTLS is in use.

To reduce the risk of Stack Overflow–style availability issues in Axum with mTLS, apply controls at the network, framework, and application layers. Use Axum’s extractors conservatively, enforce size caps, and ensure that expensive operations are gated behind validation and rate limits.

1. Limit request body size before full deserialization

Use Axum’s RequestBodyLimitLayer to cap the number of bytes read from the request body. This prevents large payloads from consuming excessive memory or tying up worker threads.

use axum::{Router, routing::post};
use axum::body::Body;
use tower_http::limit::RequestBodyLimitLayer;
use std::convert::Infallible;

async fn upload_handler(body: Body) -> &'static str {
    "received"
}

let app = Router::new()
    .route("/upload", post(upload_handler))
    .layer(RequestBodyLimitLayer::new(1024 * 64)); // 64 KiB cap

2. Validate and bound JSON extraction with size-aware extractors

Avoid eagerly binding large structures. Instead, use streaming extraction or validate size first. For strict limits, combine Json with a configured max_length on the underlying serializer.

use axum::Json;
use serde::Deserialize;
use serde_json::Value;

async fn safe_handler(Json(payload): Json) -> &'static str {
    // apply business validation here
    "ok"
}

// In your routes:
// let app = Router::new().route("/process", post(safe_handler));

3. Apply per-route and global rate limits

Rate limiting reduces the chance that many authenticated connections can amplify resource usage. Use tower_http::limit::RateLimitLayer with a token bucket per client identity (e.g., certificate hash or principal).

use tower_http::limit::RateLimitLayer;
use std::time::Duration;

let app = Router::new()
    .route("/upload", post(upload_handler))
    .layer(RateLimitLayer::new(100, Duration::from_secs(1))); // 100 requests per second

4. Enforce mTLS with strict client CA and revocation checks

Configure your TLS acceptor to require client certificates and validate them against a pinned CA. This ensures only authorized clients can reach the endpoint, reducing the impact of authenticated abuse.

use hyper_rustls::TlsAcceptor;
use std::sync::Arc;
use rustls::{ServerConfig, RootCertStore};
use std::fs::File;
use std::io::BufReader;

let mut root_store = RootCertStore::empty();
// Load your trusted client CA
let cert_file = &mut BufReader::new(File::open("client-ca.pem").unwrap());
let certs = rustls_pemfile::certs(cert_file).collect::, _>>().unwrap();
for cert in certs {
    root_store.add(&rustls::Certificate(cert)).unwrap();
}

let mut server_config = ServerConfig::builder()
    .with_safe_defaults()
    .with_no_client_auth()
    .with_client_auth_cert(vec![root_store])
    .unwrap();
// Enable client verification
server_config.client_auth_mandatory = true;
let tls_acceptor = TlsAcceptor::from(Arc::new(server_config));

middleBrick’s scans highlight missing size limits, weak rate limiting, and broad certificate permissions. By combining the above Axum patterns with continuous monitoring via the Pro plan—offering 100 APIs, continuous monitoring, and GitHub Action PR gates—you can catch regressions before they reach production.