Read the docs
TI-2021-12383 Aliases CVE-2021-32715GHSA-f3pg-qwvg-p99c

Lenient Parsing of Content-Length Header When Prefixed with Plus Sign

Priority LOW 26CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

hyper is an HTTP library for rust. hyper's HTTP/1 server code had a flaw that incorrectly parses and accepts requests with a `Content-Length` header with a prefixed plus sign, when it should have been rejected as illegal. This combined with an upstream HTTP proxy that doesn't parse such `Content-Length` headers, but forwards them, can result in "request smuggling" or "desync attacks". The flaw exists in all prior versions of hyper prior to 0.14.10, if built with `rustc` v1.5.0 or newer. The vulnerability is patched in hyper version 0.14.10. Two workarounds exist: One may reject requests manually that contain a plus sign prefix in the `Content-Length` header or ensure any upstream proxy handles `Content-Length` headers with a plus sign prefix.

Why it matters now

EPSS 0.01126 66th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed hyper (hyperium): 0.14.10hyper (crates.io): 0.14.10

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
hyperiumhyperbefore 0.14.100.14.10Patch availableCNA
—hyper (crates.io)before 0.14.100.14.10Patch availableGHSA-f3pg-qwvg-p99c
  • hyper Vendorhyperium Affected before 0.14.10 Fixed in 0.14.10 Patch available CNA
  • hyper (crates.io) Vendor— Affected before 0.14.10 Fixed in 0.14.10 Patch available GHSA-f3pg-qwvg-p99c

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hyper:hyper:*:*:*:*:*:rust:*:*before 0.14.10Vulnerablehyperium
  • cpe:2.3:a:hyper:hyper:*:*:*:*:*:rust:*:* Versions before 0.14.10 Vulnerable ·hyperium

Remediation

  • Fix · CNA hyper (hyperium) Fixed in 0.14.10
  • Fix · GHSA-f3pg-qwvg-p99c hyper (crates.io) Fixed in 0.14.10 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32715
  2. 2026-10-03 Alias added: GHSA-f3pg-qwvg-p99c

References

Exploit 1

Patch 1

Advisory 1

Other 3

  • TI-2023-11846 An issue was discovered in hyper v0.13.7. CVSS 3.1HIGH 7.5
  • TI-2022-13369 Hyperium Hyper before 0.14.19 does not allow for customization of the… CVSS 3.1HIGH 7.5
  • TI-2020-18306 An issue was discovered in the hyper crate before 0.12.34 for Rust. CVSS 3.1CRITICAL 9.8
  • TI-2021-04399 Multiple Transfer-Encoding headers misinterprets request payload CVSS 3.1HIGH 8.1
  • TI-2021-12382 Integer Overflow in Chunked Transfer-Encoding CVSS 3.1CRITICAL 9.1
  • TI-2017-13760 An issue was discovered in the hyper crate before 0.9.18 for Rust. CVSS 3.0MEDIUM 5.3
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences