Critical severity · published Dec 31, 2020
CVE-2020-35863
An issue was discovered in the hyper crate before 0.12.34 for Rust
9.8
CVSS
3%
EPSS
No
On KEV
Description
An issue was discovered in the hyper crate before 0.12.34 for Rust. HTTP request smuggling can occur. Remote code execution can occur in certain situations with an HTTP server on the loopback interface.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.0% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HY
Hyper · Hyper
before 0.12.34 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-35863
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-35863
Patch
https://rustsec.org/advisories/RUSTSEC-2020-0008.html
More from Hyper
9.8
CVE-2024-23741
An issue in Hyper on macOS version 3.4.1 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings
9.1
CVE-2021-32714
hyper is an HTTP library for Rust
8.1
CVE-2021-21299
hyper is an open-source HTTP library for Rust (crates.io)
7.5
CVE-2023-26964
An issue was discovered in hyper v0.13.7
7.5
CVE-2022-31394
Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform HTTP2 attacks