{"id":"EUVD-2021-1461","revision":"f386fdea02d547d3af1756e79dd0ddfb","records":[{"revision":"f386fdea02d547d3af1756e79dd0ddfb","observedAt":"2026-11-01T19:06:53.186+00:00","statement":{"source":"euvd","id":"EUVD-2021-1461","aliases":["CVE-2021-32715","GHSA-f3pg-qwvg-p99c"],"title":"hyper is an HTTP library for rust. hyper's HTTP/1 server code had a flaw that incorrectly parses and accepts requests with a `Content-Length` header with a prefixed plus sign, when it should have been rejected as illegal. This combined with…","description":"hyper is an HTTP library for rust. hyper's HTTP/1 server code had a flaw that incorrectly parses and accepts requests with a `Content-Length` header with a prefixed plus sign, when it should have been rejected as illegal. This combined with an upstream HTTP proxy that doesn't parse such `Content-Length` headers, but forwards them, can result in \"request smuggling\" or \"desync attacks\". The flaw exists in all prior versions of hyper prior to 0.14.10, if built with `rustc` v1.5.0 or newer. The vulnerability is patched in hyper version 0.14.10. Two workarounds exist: One may reject requests manually that contain a plus sign prefix in the `Content-Length` header or ensure any upstream proxy handles `Content-Length` headers with a plus sign prefix.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","score":3.1,"severity":null}],"references":["https://github.com/hyperium/hyper/security/advisories/GHSA-f3pg-qwvg-p99c","https://github.com/rust-lang/rust/pull/28826/commits/123a83326fb95366e94a3be1a74775df4db97739"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-1461","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 7, 2021, 8:05:11 PM","dateUpdated":"Aug 3, 2024, 11:25:31 PM"},"relatedAdvisories":[{"id":"openSUSE-SU-2024:11751-1","title":"afterburn-5.0.0-6.1 on GA media","vulnerabilityIds":["CVE-2020-35905","CVE-2020-36465","CVE-2021-27378","CVE-2021-32714","CVE-2021-32715","CVE-2021-38191","CVE-2021-45710"]},{"id":"msrc_CVE-2021-32715","title":"Lenient Parsing of Content-Length Header When Prefixed with Plus Sign","vulnerabilityIds":["CVE-2021-32715"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2021-1461","identifiers":["EUVD-2021-1461","CVE-2021-32715","GHSA-f3pg-qwvg-p99c"]},"retained":false,"historicalAffected":[]}],"coverage":[]}