Memory Leak in Axum with Mutual Tls

A memory leak in an Axum service using mutual TLS (mTLS) typically arises when TLS session state or request-handling resources are retained beyond their intended lifetime. In an mTLS setup, each client presents a certificate, and the server validates it. This validation and the associated per-connection state can introduce retention paths if the application or its dependencies hold references longer than necessary.

For example, if you store per-client metadata (authorization context, certificate-derived identifiers, or connection-specific caches) in structures keyed by a connection or TLS session identifier and never clean them up, memory usage grows with each new handshake. Axum itself does not inherently leak, but the surrounding ecosystem—hyper, Rustls, and your own state management—can create retention when combined with mTLS-specific data.

Consider a naive implementation that attaches peer certificate information to request extensions for every mTLS-authenticated call:

use axum::{routing::get, Router, Extension};
use std::sync::Arc;
use axum::extract::Request;
use hyper::Body;

async fn handler(Extension(cert_info): Extension<Arc<str>>) -> String {
    format!("Authenticated as: {}", cert_info)
}

#[tokio::main]
async fn main() {
    let app = Router::new()
        .route("/secure", get(handler))
        .layer(axum::Extension(Arc::from("example-cert"))); // simplistic static example
    axum::Server::bind(&"0.0.0.0:3000".parse().unwrap())
        .serve(app.into_make_service())
        .await
        .unwrap();
}

In a dynamic mTLS flow, if you instead attach per-request data derived from the client certificate (such as a parsed subject or a mapping from certificate fingerprint to a cached authorization decision) and fail to evict or drop these entries, you can retain objects indefinitely. This is especially risky when using global caches or lazy static structures that are never invalidated. Over time, the process heap grows, increasing GC pressure in non-Rust environments or causing Rust processes to hold onto unused allocations, which manifests as a memory leak in scans.

Additionally, certain TLS libraries and hyper integrations may keep buffers or connection objects alive if response futures are not driven to completion or if request bodies are not fully consumed. In an mTLS context, the handshake is heavier, and any dropped future or unpolled task can leave associated structures in memory. The leak may not be obvious in simple benchmarks but becomes evident under sustained mTLS traffic when middleBrick scans highlight unusual resource retention patterns through its runtime checks.

To mitigate memory leaks in Axum with mTLS, focus on strict lifetime management of per-connection or per-request data and ensure timely cleanup. Avoid storing heavy or long-lived state in request extensions; if you must carry certificate metadata, keep it lightweight and short-lived.

Use scoped tasks or explicit cleanup routines when you associate resources with TLS sessions. For example, instead of a global cache keyed by certificate fingerprint, consider a size-bounded, time-expiring cache such as moka or lru with strong eviction policies:

use axum::{routing::get, Router, Extension};
use std::sync::Arc;
use moka::sync::Cache;
use axum::extract::Request;

// A bounded cache for certificate-derived authorization decisions
lazy_static::lazy_static! {
    static ref CERT_CACHE: Cache<String, bool> = Cache::new(10_000); // max 10k entries
}

async fn authorize_with_mtls(cert_der: &[u8]) -> bool {
    let key = hex::encode(cert_der);
    if let Some(cached) = CERT_CACHE.get(&key) {
        return *cached;
    }
    // Perform actual validation (placeholder)
    let valid = validate_certificate(cert_der).unwrap_or(false);
    CERT_CACHE.insert(key, valid);
    valid
}

async fn handler(req: Request) -> axum::response::Response {
    let cert = extract_client_cert(&req); // hypothetical extraction
    if authorize_with_mtls(&cert).await {
        axum::response::Response::new(Body::from("OK"))
    } else {
        axum::response::Response::builder()
            .status(403)
            .body(Body::empty())
            .unwrap()
    }
}

fn extract_client_cert(req: &Request) -> Vec<u8> {
    // Implementation-specific extraction from TLS extensions
    vec![0xDE, 0xAD, 0xBE, 0xEF]
}

fn validate_certificate(cert_der: &[u8]) -> Result<bool, Box<dyn std::error::Error + Send + Sync>> {
    // Real validation logic using Rustls or similar
    Ok(true)
}

Ensure that any futures spawned per connection are properly awaited or cancelled to avoid orphaned tasks holding references. If you integrate with TLS acceptors that provide peer certificates, consume them immediately within the handler and avoid storing them in long-lived structures. With these patterns, the mTLS flow remains efficient and avoids retention that middleBrick would flag as a leak.

For teams using the ecosystem around Axum, the CLI can be useful to verify that changes do not introduce regressions. You can scan from terminal with middlebrick scan <url> to validate that your mTLS endpoints remain within acceptable risk profiles after remediation.