CVE-2020-35863 json
HTTP Request Smuggling in hyper
published 2020-03-19 6 y ago modified 2026-06-17 4 mo ago also GHSA-h3qr-rq2j-74w4 , RUSTSEC-2020-0008 , EUVD-2021-1736
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.0%
- EPSS 3.0% chance of exploitation in 30 days, percentile 87%
- public exploits
- 0
- none known
Summary
An issue was discovered in the hyper crate before 0.12.34 for Rust. HTTP request smuggling can occur. Remote code execution can occur in certain situations with an HTTP server on the loopback interface.
Patch / fix
- crates.io hyper 0.12.34
- hyper hyper 0.12.34
- rust-hyper Debian 14, Debian 13, Debian 12 0.12.35-1
debian advisories DEBIAN-CVE-2020-35863
Exploit prediction
2.97% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| OSV | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | hyper | >=0.11.0, <0.12.34 |
0.12.34 |
Classification
- Weakness
-
- CWE-444 Inconsistent Interpretation of HTTP Requests
References
-
rustsec.org
/advisories/RUSTSEC-2020-0008.html
web, patch, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-35863
advisory
-
github.com
/hyperium/hyper/issues/1925
web, report
-
github.com
/hyperium/hyper
package
-
crates.io
/crates/hyper
package
Sources
- CVE List CVE-2020-35863
- GitHub Advisory GHSA-h3qr-rq2j-74w4
- NVD CVE-2020-35863
- OSV RUSTSEC-2020-0008
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.