Vulnerability RUSTSEC-2021-0020
High Risk
HIGH RISK
CVSS Score: 8.1
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
5 years ago
February 05, 2021 at 12:00 PM UTC
Multiple Transfer-Encoding headers misinterprets request payload
0.12.0 - 0.12.35
0.12.0 - 0.12.35
Summary
Multiple Transfer-Encoding headers misinterprets request payload
Details
hyper's HTTP server code had a flaw that incorrectly understands some requests with multiple transfer-encoding headers to have a chunked payload, when it should have been rejected as illegal. This combined with an upstream HTTP proxy that understands the request payload boundary differently can result in "request smuggling" or "desync attacks".
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
4 years ago
Parser creates invalid uninitialized value
0.0.1 - 0.12.36 and 0.13.0 - 0.14.11 GHSA-f67m-9j94-qv9j
0.0.1 - 0.12.36 and 0.13.0 - 0.14.11 GHSA-f67m-9j94-qv9j
Unknown
4 years ago
Parser creates invalid uninitialized value
0.0.1 - 0.12.36 and 0.13.0 - 0.14.11 RUSTSEC-2022-0022
0.0.1 - 0.12.36 and 0.13.0 - 0.14.11 RUSTSEC-2022-0022
Medium Risk
5 years ago
HTTP Request Smuggling in hyper
0.12.0 - 0.12.35 and 0.13.0 - 0.13.9 and 0.14.0 - 0.14.2 GHSA-6hfq-h8hq-87mf
0.12.0 - 0.12.35 and 0.13.0 - 0.13.9 and 0.14.0 - 0.14.2 GHSA-6hfq-h8hq-87mf
Critical
5 years ago
HTTP Request Smuggling in hyper
0.11.0 - 0.12.33 GHSA-h3qr-rq2j-74w4
0.11.0 - 0.12.33 GHSA-h3qr-rq2j-74w4
Medium Risk
5 years ago
HTTPS MitM vulnerability due to lack of hostname verification
0.0.1 - 0.9.3 GHSA-9xjr-m6f3-v5wm
0.0.1 - 0.9.3 GHSA-9xjr-m6f3-v5wm
Impacted packages
Timeline
Published
5 years ago
February 05, 2021 at 12:00 PM UTC
Fixed (0.13.10)
5 years ago
February 05, 2021 at 10:48 PM UTC
Fixed (0.14.3)
5 years ago
February 05, 2021 at 10:49 PM UTC
Fixed (0.12.36)
5 years ago
February 18, 2021 at 03:02 AM UTC
Last Modified
1 hour ago
October 12, 2026 at 06:00 PM UTC