PT-2021-6699 · Hyper · Hyper

Asta Olofsson + 1 · Published 2021-07-07 · Updated 2026-02-18 · CVE-2021-32714

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions hyper versions prior to 0.14.10

Description The issue is related to an integer overflow when decoding chunk sizes that are too big, which can trigger data loss or, in certain cases, "request smuggling" or "desync attacks" if combined with an upstream HTTP proxy that allows larger chunk sizes. This can occur when using hyper for any HTTP/1 purpose, including as a client or server, and consumers send requests or responses that specify a chunk size greater than 18 exabytes. For a possible request smuggling attack to be possible, any upstream proxies must accept a chunk size greater than 64 bits.

Recommendations To resolve the issue, upgrade to version 0.14.10 or later. As a temporary workaround, consider rejecting requests manually that contain a Transfer-Encoding header. Alternatively, ensure any upstream proxy rejects Transfer-Encoding chunk sizes greater than what fits in 64-bit unsigned integers.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BDU:2022-02054

CVE-2021-32714

GHSA-5H46-H7HH-C6X9

OPENSUSE-SU-2024:11751-1

RUSTSEC-2021-0079

Affected Products

Hyper

References · 16

• 🔥 https://github.com/hyperium/hyper/security/advisories/GHSA-5h46-h7hh-c6x9 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-32714 · Security Note
• https://ubuntu.com/security/CVE-2021-32714 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2021-0079 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-32714 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-32714 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02054 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-32714 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32714 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5h46-h7hh-c6x9 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-32714 · Security Note
• https://github.com/hyperium/hyper · Note
• https://t.me/cibsecurity/25990 · Telegram Post
• https://t.me/msrcreports/3126 · Telegram Post
• https://rustsec.org/advisories/RUSTSEC-2021-0079.html · Note