CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2020-35863
Critical (9.8) in hyper hyper. EPSS 3.0% chance of exploitation in the next 30 days. Fixed in hyper 0.12.34.
An issue was discovered in the hyper crate before 0.12.34 for Rust. HTTP request smuggling can occur. Remote code execution can occur in certain situations with an HTTP server on the loopback interface.
Severity
- EPSS
- 3.0% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
- CWE
- CWE-444
- Published
- Modified
- Record from
- the NVD, synced
Affected
- hyper:hyper
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-h3qr-rq2j-74w4 | crates.io | hyper | >=0.11.0 <0.12.34 | 0.12.34 |
| RUSTSEC-2020-0008 | crates.io | hyper | >=0.11.0 <0.12.34 | 0.12.34 |