CVSS: 10.0EPSS: 25%CPEs: 1EXPL: 1CVE-2024-23741
https://notcve.org/view.php?id=CVE-2024-23741
28 Jan 2024 — An issue in Hyper on macOS version 3.4.1 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. Un problema en Hyper en macOS versión 3.4.1 y anteriores permite a atacantes remotos ejecutar código arbitrario a través de la configuración RunAsNode y enableNodeClilnspectArguments. • https://github.com/giovannipajeu1/CVE-2024-23741 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2023-26964 – openSUSE Security Advisory - openSUSE-SU-2024:0294-1
https://notcve.org/view.php?id=CVE-2023-26964
11 Apr 2023 — An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STREAM frames. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS). An update that solves three vulnerabilities and has one errata is now available. This update for kanidm fixes the following issues. • https://github.com/hyperium/hyper/issues/2877 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-31394 – SUSE Security Advisory - SUSE-SU-2024:0090-1
https://notcve.org/view.php?id=CVE-2022-31394
21 Feb 2023 — Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform HTTP2 attacks. This update for sccache fixes the following issues. Fixed possible code injection via LD_PRELOAD to sccache server. Fixed a denial-of-service vulnerability via header list size. • https://github.com/hyperium/hyper/compare/v0.14.18...v0.14.19 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-39294 – (DoS) Denial of Service from unchecked request length in conduit-hyper
https://notcve.org/view.php?id=CVE-2022-39294
31 Oct 2022 — conduit-hyper integrates a conduit application with the hyper server. Prior to version 0.4.2, `conduit-hyper` did not check any limit on a request's length before calling [`hyper::body::to_bytes`](https://docs.rs/hyper/latest/hyper/body/fn.to_bytes.html). An attacker could send a malicious request with an abnormally large `Content-Length`, which could lead to a panic if memory allocation failed for that request. In version 0.4.2, `conduit-hyper` sets an internal limit of 128 MiB per request, otherwise retur... • https://github.com/conduit-rust/conduit-hyper/security/advisories/GHSA-9398-5ghf-7pr6 • CWE-400: Uncontrolled Resource Consumption CWE-1284: Improper Validation of Specified Quantity in Input •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2021-32715 – Lenient Parsing of Content-Length Header When Prefixed with Plus Sign
https://notcve.org/view.php?id=CVE-2021-32715
07 Jul 2021 — hyper is an HTTP library for rust. hyper's HTTP/1 server code had a flaw that incorrectly parses and accepts requests with a `Content-Length` header with a prefixed plus sign, when it should have been rejected as illegal. This combined with an upstream HTTP proxy that doesn't parse such `Content-Length` headers, but forwards them, can result in "request smuggling" or "desync attacks". The flaw exists in all prior versions of hyper prior to 0.14.10, if built with `rustc` v1.5.0 or newer. The vulnerability is... • https://github.com/hyperium/hyper/security/advisories/GHSA-f3pg-qwvg-p99c • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-32714 – Integer Overflow in Chunked Transfer-Encoding
https://notcve.org/view.php?id=CVE-2021-32714
07 Jul 2021 — hyper is an HTTP library for Rust. In versions prior to 0.14.10, hyper's HTTP server and client code had a flaw that could trigger an integer overflow when decoding chunk sizes that are too big. This allows possible data loss, or if combined with an upstream HTTP proxy that allows chunk sizes larger than hyper does, can result in "request smuggling" or "desync attacks." The vulnerability is patched in version 0.14.10. Two possible workarounds exist. • https://github.com/hyperium/hyper/security/advisories/GHSA-5h46-h7hh-c6x9 • CWE-190: Integer Overflow or Wraparound •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21299 – Multiple Transfer-Encoding headers misinterprets request payload
https://notcve.org/view.php?id=CVE-2021-21299
11 Feb 2021 — hyper is an open-source HTTP library for Rust (crates.io). In hyper from version 0.12.0 and before versions 0.13.10 and 0.14.3 there is a vulnerability that can enable a request smuggling attack. The HTTP server code had a flaw that incorrectly understands some requests with multiple transfer-encoding headers to have a chunked payload, when it should have been rejected as illegal. This combined with an upstream HTTP proxy that understands the request payload boundary differently can result in "request smugg... • https://crates.io/crates/hyper • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 0CVE-2020-35863
https://notcve.org/view.php?id=CVE-2020-35863
31 Dec 2020 — An issue was discovered in the hyper crate before 0.12.34 for Rust. HTTP request smuggling can occur. Remote code execution can occur in certain situations with an HTTP server on the loopback interface. Se detectó un problema en la crate hyper versiones anteriores a 0.12.34 para Rust. Un tráfico no autorizado de peticiones HTTP puede ocurrir. • https://rustsec.org/advisories/RUSTSEC-2020-0008.html • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2017-18587
https://notcve.org/view.php?id=CVE-2017-18587
26 Aug 2019 — An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers. Se descubrió un problema en el paquete (crate) hyper versiones anteriores a 0.9.18 para Rust. Maneja inapropiadamente newlines en los encabezados. • https://rustsec.org/advisories/RUSTSEC-2017-0002.html • CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') •
CVSS: 5.8EPSS: 0%CPEs: 2EXPL: 0CVE-2016-10932
https://notcve.org/view.php?id=CVE-2016-10932
26 Aug 2019 — An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted. Se descubrió un problema en el paquete hiper en versiones anterior a la 0.9.4 para Rust en Windows. Hay una vulnerabilidad de dominio en el medio HTTPS porque se omitió la verificación del nombre de host. • https://rustsec.org/advisories/RUSTSEC-2016-0002.html • CWE-254: 7PK - Security Features •