CVE-2021-32714 - CVE House
Back to Database
Status published Medium CVE-2021-32714

Integer Overflow in Chunked Transfer-Encoding

Vulnerability Description

hyper is an HTTP library for Rust. In versions prior to 0.14.10, hyper's HTTP server and client code had a flaw that could trigger an integer overflow when decoding chunk sizes that are too big. This allows possible data loss, or if combined with an upstream HTTP proxy that allows chunk sizes larger than hyper does, can result in "request smuggling" or "desync attacks." The vulnerability is patched in version 0.14.10. Two possible workarounds exist. One may reject requests manually that contain a `Transfer-Encoding` header or ensure any upstream proxy rejects `Transfer-Encoding` chunk sizes greater than what fits in 64-bit unsigned integers.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-32714

Credits & Attribution

No credits recorded in the NVD database.

References

More from hyperium

View All →
CVE-2024-47609
Remotely exploitable DoS in Tonic `<=v0.12.2`
Medium 6.9
CVE-2021-32715
Lenient Parsing of Content-Length Header When Prefixed with Plus Sign
Low 3.1
CVE-2021-21299
Multiple Transfer-Encoding headers misinterprets request payload
Medium 4.8

Affected Vendor

Affected Software

hyper
Vulnerable Versions:
< 0.14.10

Timeline

Official Publish: July 7th, 2021
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-190

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1055 Process Injection
Defense Evasion
T1105 Ingress Tool Transfer
Command and Control
T1499 Endpoint Denial of Service
Impact