What is CVE-2020-35863?

CVE-2020-35863 is a critical-severity vulnerability in Hyper, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 9.8/10. Published 2020-12-31.

How severe is CVE-2020-35863?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2020-35863 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Hyper

CVE-2020-35863

An issue was discovered in the hyper crate before 0.12.34 for Rust. HTTP request smuggling can occur. Remote code execution can occur in certain situations with an HTTP server on the loopback interface.

Vulnerability class: HTTP Request Smuggling

EPSS: 0.028 (85.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Hyper
N/a — versions n/a

Weakness classification (CWE)

CWE-444 — Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling)

Public proof-of-concept exploits

Artisan-Lab/Rust-memory-safety-bugs

References

cve@mitre.org (Patch, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2020-35863?: CVE-2020-35863 is a critical-severity vulnerability in Hyper, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 9.8/10. Published 2020-12-31.
How severe is CVE-2020-35863?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2020-35863 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.