CVE-2021-32714 — Integer Overflow or Wraparound in Hyper

CWE-190 — Integer Overflow or Wraparound8 documents6 sources
Severity
9.1CRITICALNVD
EPSS
0.4%
top 39.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
Hyperium HyperHyperDebian Rust-hyper+5 more
Timeline
PublishedJul 7
Latest updateSep 23

Description

hyper is an HTTP library for Rust. In versions prior to 0.14.10, hyper's HTTP server and client code had a flaw that could trigger an integer overflow when decoding chunk sizes that are too big. This allows possible data loss, or if combined with an upstream HTTP proxy that allows chunk sizes larger than hyper does, can result in "request smuggling" or "desync attacks." The vulnerability is patched in version 0.14.10. Two possible workarounds exist. One may reject requests manually that contain …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HExploitability: 3.9 | Impact: 5.2

Affected Packages9 packages

▶debiandebian/rust-hyper< rust-hyper 0.14.19-1 (bookworm)
▶NVDhyper/hyper< 0.14.10
▶crates.iohyper/hyper0.0.0-0 — 0.14.10+1
▶CVEListV5hyperium/hyper< 0.14.10

🔴Vulnerability Details

4
OSV
Integer Overflow in Chunked Transfer-Encoding↗2021-07-12
▶
GHSA
Integer Overflow in Chunked Transfer-Encoding↗2021-07-12
▶
OSV
CVE-2021-32714: hyper is an HTTP library for Rust↗2021-07-07
▶
OSV
Integer overflow in `hyper`'s parsing of the `Transfer-Encoding` header leads to data loss↗2021-07-07
▶

📋Vendor Advisories

2
Microsoft
Integer Overflow in Chunked Transfer-Encoding↗2021-07-13
▶
Debian
CVE-2021-32714: rust-hyper - hyper is an HTTP library for Rust. In versions prior to 0.14.10, hyper's HTTP se...↗2021
▶

📄Research Papers

1
arXiv
Security Review of Ethereum Beacon Clients↗2021-09-23
▶
CVE-2021-32714 — Integer Overflow or Wraparound | cvebase