CVE-2020-35863 HTTP Request Smuggling in hyper
Attackers can exploit HTTP request smuggling in the hyper crate to achieve remote code execution on loopback servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-35863?
CVE-2020-35863 is a critical vulnerability in n/a, published on 31 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the hyper crate before 0.12.34 for Rust. HTTP request smuggling can occur. Remote code execution can occur in certain situations with an HTTP server on the loopback interface.
Weakness: CWE-444
Which versions are affected by CVE-2020-35863?
3 open source packages ship an affected version, including hyper. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
hyper crates.io | From 0.11.0 | 0.12.34 |
hyper crates.io | From 0.11.0 | 0.12.34 |
hyper crates.io | From 0.11.0 | 0.12.34 |
Products include Hyper Hyper.
How do I fix CVE-2020-35863?
Upgrade hyper to 0.12.34 or later.
Is CVE-2020-35863 being exploited?
There is no known exploitation of CVE-2020-35863 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2022-31394 Denial of service in n/a
- CVE-2021-32714 Integer Overflow in Chunked Transfer-Encoding
- CVE-2017-18587 Headers containing newline characters can split messages in hyper
- CVE-2021-21299 Multiple Transfer-Encoding headers misinterprets request payload
- CVE-2016-10932 HTTPS MitM vulnerability due to lack of hostname verification
Sources
Also known as DEBIAN-CVE-2020-35863, GHSA-h3qr-rq2j-74w4, RUSTSEC-2020-0008.