4 results · Clear filters · Feed
-
Medium 5.9
Integer Overflow in Chunked Transfer-Encoding
hyper is an HTTP library for Rust. In versions prior to 0.14.10, hyper's HTTP server and client code had a flaw that could trigger an integer overflow when decoding chunk sizes that are too big. This allows possible data loss, or if combined with an upstream …
-
Medium 4.8
Multiple Transfer-Encoding headers misinterprets request payload
hyper is an open-source HTTP library for Rust (crates.io). In hyper from version 0.12.0 and before versions 0.13.10 and 0.14.3 there is a vulnerability that can enable a request smuggling attack. The HTTP server code had a flaw that incorrectly understands so…
-
Medium 5.3
Headers containing newline characters can split messages in hyper
An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers.
-
Medium 4.8
HTTPS MitM vulnerability due to lack of hostname verification
An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted.