{"cve":"CVE-2021-32714","nvd":{"published":"2021-07-07T20:15:08.650","modified":"2026-06-17T03:53:28.940","status":"Modified","description":"hyper is an HTTP library for Rust. In versions prior to 0.14.10, hyper's HTTP server and client code had a flaw that could trigger an integer overflow when decoding chunk sizes that are too big. This allows possible data loss, or if combined with an upstream HTTP proxy that allows chunk sizes larger than hyper does, can result in \"request smuggling\" or \"desync attacks.\" The vulnerability is patched in version 0.14.10. Two possible workarounds exist. One may reject requests manually that contain a `Transfer-Encoding` header or ensure any upstream proxy rejects `Transfer-Encoding` chunk sizes greater than what fits in 64-bit unsigned integers.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","score":9.1},"cwes":["CWE-190"],"references":["https://github.com/hyperium/hyper/security/advisories/GHSA-5h46-h7hh-c6x9","https://github.com/hyperium/hyper/security/advisories/GHSA-5h46-h7hh-c6x9"],"products":["hyper:hyper"],"source":"nvd","synced_at":"2026-10-19T21:20:07.141963181+00:00"},"epss":{"cve":"CVE-2021-32714","score":0.01155,"percentile":0.67025,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-5h46-h7hh-c6x9","url":"https://osv.dev/vulnerability/GHSA-5h46-h7hh-c6x9","summary":"Integer Overflow in Chunked Transfer-Encoding","modified":"2026-09-10T03:49:06.305959060Z","packages":[{"ecosystem":"crates.io","name":"hyper","purl":"pkg:cargo/hyper","ranges":["<0.14.10"],"fixed":["0.14.10"]}]},{"id":"RUSTSEC-2021-0079","url":"https://osv.dev/vulnerability/RUSTSEC-2021-0079","summary":"Integer overflow in `hyper`'s parsing of the `Transfer-Encoding` header leads to data loss","modified":"2026-10-12T18:00:02.671544457Z","packages":[{"ecosystem":"crates.io","name":"hyper","purl":"pkg:cargo/hyper","ranges":[">=0.0.0-0 <0.14.10"],"fixed":["0.14.10"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}