Executive brief
Multiple Transfer-Encoding headers misinterprets request payload
Affected products
- crates.io hyper
Junglewise Threat Intelligence
CVE-2021-21299: RUSTSEC-2021-0020 - Multiple Transfer-Encoding headers misinterprets request payload
CVE-2021-21299 · Severity: low · CVSS 3.1 · Published 2021-02-05
Technologies: hyper (crates.io). Vendors: crates.io.
Related threats
- Parser creates invalid uninitialized value
- RUSTSEC-2022-0022 - Parser creates invalid uninitialized value
- RUSTSEC-2021-0078 - Lenient `hyper` header parsing of `Content-Length` could allow request smuggling
- RUSTSEC-2021-0079 - Integer overflow in `hyper`'s parsing of the `Transfer-Encoding` header leads to data loss
- RUSTSEC-2020-0008 - Flaw in hyper allows request smuggling by sending a body in GET requests