Vulnerability in Hyper
CVE-2021-32715
hyper is an HTTP library for rust. hyper's HTTP/1 server code had a flaw that incorrectly parses and accepts requests with a `Content-Length` header with a prefixed plus sign, when it should have been rejected as illegal. This combined with an upstream HTTP proxy that doesn't parse such `Content-Length` headers, but forwards them, can result in "request smuggling" or "desync attacks". The flaw exists in all prior versions of hyper prior to 0.14.10, if built with `rustc` v1.5.0 or newer. The vulnerability is patched in hyper version 0.14.10. Two workarounds exist: One may reject requests manually that contain a plus sign prefix in the `Content-Length` header or ensure any upstream proxy handles `Content-Length` headers with a plus sign prefix.
Vulnerability class: HTTP Request Smuggling
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.1 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.010 (60.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 60th percentile — 60.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.010 · change: +0.001
Affected products
- Hyper
- Hyperium Hyper — versions < 0.14.10
Weakness classification (CWE)
References
- github.com/hyperium/hyper/security/advisories/GHSA-f3pg-qwvg-p99c (Exploit, Third Party Advisory)
- github.com/rust-lang/rust/pull/28826/commits/123a83326fb95366e94a3be1a74775df4d… (Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2021-32715?
- CVE-2021-32715 is a low-severity vulnerability in Hyper, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 3.1/10. Published 2021-07-07.
- How severe is CVE-2021-32715?
- Low severity. CVSS v3 base score is 3.1 out of 10.