{"id":"EUVD-2021-1461","enisaUuid":"3810fdb2-7210-39d6-93f9-f0966c03fa48","description":"hyper is an HTTP library for rust. hyper\u0027s HTTP/1 server code had a flaw that incorrectly parses and accepts requests with a `Content-Length` header with a prefixed plus sign, when it should have been rejected as illegal. This combined with an upstream HTTP proxy that doesn\u0027t parse such `Content-Length` headers, but forwards them, can result in \"request smuggling\" or \"desync attacks\". The flaw exists in all prior versions of hyper prior to 0.14.10, if built with `rustc` v1.5.0 or newer. The vulnerability is patched in hyper version 0.14.10. Two workarounds exist: One may reject requests manually that contain a plus sign prefix in the `Content-Length` header or ensure any upstream proxy handles `Content-Length` headers with a plus sign prefix.","datePublished":"Jul 7, 2021, 8:05:11 PM","dateUpdated":"Aug 3, 2024, 11:25:31 PM","baseScore":3.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","references":"https://github.com/hyperium/hyper/security/advisories/GHSA-f3pg-qwvg-p99c\nhttps://github.com/rust-lang/rust/pull/28826/commits/123a83326fb95366e94a3be1a74775df4db97739\n","aliases":"CVE-2021-32715\nGHSA-f3pg-qwvg-p99c\n","assigner":"GitHub_M","epss":1.13,"enisaIdProduct":[{"id":"1349351d-adf4-3f3e-9945-77a3ae4613c3","product":{"name":"hyper","vendor":{"name":"vercel"}},"product_version":"\u003c 0.14.10"}],"enisaIdVendor":[{"id":"53c3801a-326c-382d-ba96-ccc80e9ca534","vendor":{"name":"hyperium"}}],"enisaIdVulnerability":[{"id":"785b45e9-39cc-3423-942b-294505b89326","vulnerability":{"id":"CVE-2021-32715","description":"hyper is an HTTP library for rust. hyper\u0027s HTTP/1 server code had a flaw that incorrectly parses and accepts requests with a `Content-Length` header with a prefixed plus sign, when it should have been rejected as illegal. This combined with an upstream HTTP proxy that doesn\u0027t parse such `Content-Length` headers, but forwards them, can result in \"request smuggling\" or \"desync attacks\". The flaw exists in all prior versions of hyper prior to 0.14.10, if built with `rustc` v1.5.0 or newer. The vulnerability is patched in hyper version 0.14.10. Two workarounds exist: One may reject requests manually that contain a plus sign prefix in the `Content-Length` header or ensure any upstream proxy handles `Content-Length` headers with a plus sign prefix.","datePublished":"Jul 7, 2021, 8:05:11 PM","dateUpdated":"Aug 3, 2024, 11:25:31 PM","status":"PUBLISHED","baseScore":3.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","references":"https://github.com/hyperium/hyper/security/advisories/GHSA-f3pg-qwvg-p99c\nhttps://github.com/rust-lang/rust/pull/28826/commits/123a83326fb95366e94a3be1a74775df4db97739\n","enisa_id":"EUVD-2021-1461\n","assigner":"GitHub_M","epss":1.13,"dataProcessed":"Nov 1, 2026, 7:19:47 AM","vulnerabilityProduct":[{"id":"8996d952-b813-386d-9488-313f01ac5445","product":{"name":"hyper","vendor":{"name":"vercel"}},"product_version":"\u003c 0.14.10"}],"vulnerabilityVendor":[{"id":"9c22a41e-4011-3478-b76a-5d037e4111c4","vendor":{"name":"hyperium"}}]}},{"id":"d81da614-d154-387d-990d-c5b72cc58491","vulnerability":{"id":"GHSA-f3pg-qwvg-p99c","description":"Lenient Parsing of Content-Length Header When Prefixed with Plus Sign","datePublished":"Jul 12, 2021, 4:54:20 PM","dateUpdated":"Sep 7, 2021, 9:49:21 PM","baseScore":null,"references":"https://github.com/hyperium/hyper/security/advisories/GHSA-f3pg-qwvg-p99c\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-32715\nhttps://github.com/rust-lang/rust/pull/28826/commits/123a83326fb95366e94a3be1a74775df4db97739\nhttps://github.com/hyperium/hyper/commit/1fb719e0b61a4f3d911562a436a2ff05fd7cb759\nhttps://github.com/hyperium/hyper\nhttps://rustsec.org/advisories/RUSTSEC-2021-0078.html\n","enisa_id":"EUVD-2021-1461\n","aliases":"CVE-2021-32715\nGHSA-f3pg-qwvg-p99c\n","epss":0.0,"dataProcessed":"Apr 21, 2026, 4:03:33 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"408097f3-58f7-3dfe-975c-b9b0027cac2c","advisory":{"id":"openSUSE-SU-2024:11751-1","description":"afterburn-5.0.0-6.1 on GA media","summary":"afterburn-5.0.0-6.1 on GA media","datePublished":"Jun 15, 2024, 12:00:00 AM","dateUpdated":"Sep 20, 2026, 8:24:54 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_11751-1.json\nhttps://www.suse.com/security/cve/CVE-2020-35905/\nhttps://www.suse.com/security/cve/CVE-2020-36465/\nhttps://www.suse.com/security/cve/CVE-2021-27378/\nhttps://www.suse.com/security/cve/CVE-2021-32714/\nhttps://www.suse.com/security/cve/CVE-2021-32715/\nhttps://www.suse.com/security/cve/CVE-2021-38191/\nhttps://www.suse.com/security/cve/CVE-2021-45710/\n","aliases":"CVE-2020-35905\nCVE-2020-36465\nCVE-2021-27378\nCVE-2021-32714\nCVE-2021-32715\nCVE-2021-38191\nCVE-2021-45710\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"00979d48-0e5c-3d5e-bc39-ac4f1324959a","product":{"name":"afterburn-5.0.0-6.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"0f75ae50-143f-385e-b992-dc051ce37c07","product":{"name":"afterburn-5.0.0-6.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"16d4a905-0b40-3eae-8dee-9785cc869115","product":{"name":"afterburn-dracut-5.0.0-6.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"173d673c-ac25-33f6-af89-f9b000ee9193","product":{"name":"afterburn-dracut-5.0.0-6.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"1f39457b-2ff1-3ec5-8d5b-b8e7e920f8a4","product":{"name":"afterburn-0:5.0.0-6.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"42563f4b-5265-3573-896c-3e6ecaa51fb9","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"501b5abf-8d67-3c86-8be8-5f087952435f","product":{"name":"afterburn-0:5.0.0-6.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"602ac3fa-0191-3655-977c-38ff67cc5802","product":{"name":"afterburn-dracut-5.0.0-6.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"6723e23e-53b4-35f0-8e3b-e0eecc1efcd7","product":{"name":"afterburn-dracut-0:5.0.0-6.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"6c23e992-bff7-3e34-b4a4-eb7be249abd7","product":{"name":"afterburn-dracut-0:5.0.0-6.1.s390x","vendor":{"name":"SUSE"}}},{"id":"8acc6c02-eaed-34a3-a0ca-a7df84999e49","product":{"name":"afterburn-dracut-0:5.0.0-6.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"a009ee4d-86aa-385b-b551-5cd1a04abe9b","product":{"name":"afterburn-5.0.0-6.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"a0fa9f7d-27ab-307a-8705-28c341df1bf4","product":{"name":"afterburn-0:5.0.0-6.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"c2f2254e-40b6-3752-9c00-ca3f4be12a40","product":{"name":"afterburn-5.0.0-6.1.s390x","vendor":{"name":"SUSE"}}},{"id":"c92451b5-6c65-3139-aad5-3b891cbfcc08","product":{"name":"afterburn-dracut-0:5.0.0-6.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"dd07d4f8-4200-39d0-bf23-28b785c43889","product":{"name":"afterburn-0:5.0.0-6.1.s390x","vendor":{"name":"SUSE"}}},{"id":"f9c64fa9-30a7-3093-a08c-8ca93c5c4eea","product":{"name":"afterburn-dracut-5.0.0-6.1.s390x","vendor":{"name":"SUSE"}}}]}},{"id":"909f0c5a-adf3-3551-ba87-cda327c19264","advisory":{"id":"msrc_CVE-2021-32715","description":"Lenient Parsing of Content-Length Header When Prefixed with Plus Sign","datePublished":"Jul 2, 2021, 12:00:00 AM","dateUpdated":"Feb 18, 2026, 3:11:39 PM","baseScore":0.0,"references":"https://msrc.microsoft.com/csaf/vex/2021/msrc_cve-2021-32715.json\n","aliases":"CVE-2021-32715\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"0545d42c-eba0-3fe4-9162-7a39a107d16a","product":{"name":"rpm-ostree","vendor":{"name":"Microsoft"}}},{"id":"4531d4b5-709c-39b1-a68d-685cd7b02630","product":{"name":"Azure Linux","vendor":{"name":"Microsoft"}}},{"id":"6c78d709-0811-3881-a1b9-b2eff4172616","product":{"name":"3.0","vendor":{"name":"Wind River"}}},{"id":"9cc1714d-ecb6-3b47-a567-2a4386e086bc","product":{"name":"azl3 rpm-ostree 2024.4-1","vendor":{"name":"Microsoft"}}},{"id":"a8a3ae7a-a9f9-3bbc-9bc9-1b50e52ab6e3","product":{"name":"azl3 mozjs 102.15.1-1","vendor":{"name":"Microsoft"}}},{"id":"dd6abeeb-4671-3187-8ea1-5879d24b8fd0","product":{"name":"azl3 rpm-ostree 2022.1-7","vendor":{"name":"Microsoft"}}}]}}]}