Read the docs
TI-2016-08970 Aliases CVE-2016-10932GHSA-9xjr-m6f3-v5wm

An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows.

Priority LOW 23CWE-254Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-347.

Summary

An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted.

Why it matters now

EPSS 0.00738 54th percentileScored 2026-11-07
Fix Fixed hyper (crates.io): 0.9.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—hyper (crates.io)before 0.9.40.9.4Patch availableGHSA-9xjr-m6f3-v5wm
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • hyper (crates.io) Vendor— Affected before 0.9.4 Fixed in 0.9.4 Patch available GHSA-9xjr-m6f3-v5wm

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:hyper:hyper:*:*:*:*:*:*:*:*before 0.9.4Vulnerablehyperium
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:hyper:hyper:*:*:*:*:*:*:*:* Versions before 0.9.4 Vulnerable ·hyperium
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · GHSA-9xjr-m6f3-v5wm hyper (crates.io) Fixed in 0.9.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-10932
  2. 2026-10-03 Alias added: GHSA-9xjr-m6f3-v5wm

References

Advisory 2

Other 3

  • TI-2023-11846 An issue was discovered in hyper v0.13.7. CVSS 3.1HIGH 7.5
  • TI-2022-13369 Hyperium Hyper before 0.14.19 does not allow for customization of the… CVSS 3.1HIGH 7.5
  • TI-2020-18306 An issue was discovered in the hyper crate before 0.12.34 for Rust. CVSS 3.1CRITICAL 9.8
  • TI-2021-04399 Multiple Transfer-Encoding headers misinterprets request payload CVSS 3.1HIGH 8.1
  • TI-2021-12382 Integer Overflow in Chunked Transfer-Encoding CVSS 3.1CRITICAL 9.1
  • TI-2021-12383 Lenient Parsing of Content-Length Header When Prefixed with Plus Sign CVSS 3.1MEDIUM 5.3
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences