RUSTSEC-2022-0055: No default limit put on request bodies

> No default limit put on request bodies

| Details | |
| ------------------- | ---------------------------------------------- |
| Package | `axum-core` |
| Version | `0.1.2` |
| URL | [https://github.com/tokio-rs/axum/pull/1346](https://github.com/tokio-rs/axum/pull/1346) |
| Date | 2022-08-31 |
| Patched versions | `>=0.2.8, <0.3.0-rc.1,>=0.3.0-rc.2` |

`<bytes::Bytes as axum_core::extract::FromRequest>::from_request` would not, by
default, set a limit for the size of the request body. That meant if a malicious
peer would send a very large (or infinite) body your server might run out of
memory and crash.

This also applies to these extractors which used `Bytes::from_request`
internally:
- `axum::extract::Form`
- `axum::extract::Json`
- `String`

The fix is also in `axum-core` `0.3.0.rc.2` but `0.3.0.rc.1` _is_ vulnerable.

Because `axum` depends on `axum-core` it is vulnerable as well. The vulnerable
versions of `axum` are `<= 0.5.15` and `0.6.0.rc.1`. `axum` `>= 0.5.16` and
`>= 0.6.0.rc.2` does have the fix and are not vulnerable.

The patched versions will set a 2 MB limit by default.

See [advisory page](https://rustsec.org/advisories/RUSTSEC-2022-0055.html) for additional details.

Start with the RustSec advisory and the linked axum pull request, then trace axum_core::extract::FromRequest for Bytes and the listed Form, Json, and String extractors. Done means request bodies have the stated 2 MB default limit and the affected axum and axum-core versions are no longer vulnerable.

Written by the indexing model from the issue text.