{"id":"CVE-2021-21299","aliases":["RUSTSEC-2021-0020","GHSA-6hfq-h8hq-87mf"],"title":"Multiple Transfer-Encoding headers misinterprets request payload","summary":"Multiple Transfer-Encoding headers misinterprets request payload","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","vendor":"hyper","product":"hyper","ecosystem":"rust","affected":["hyper >= 0.14.0-0, < 0.14.3"],"patched":["hyper 0.14.3"],"published":"2021-02-05","updated":"2026-10-12","sourceUpdated":"2026-10-12T18:00:04.410731844Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2021-0020","references":[{"url":"https://crates.io/crates/hyper"},{"url":"https://rustsec.org/advisories/RUSTSEC-2021-0020.html"},{"url":"https://github.com/hyperium/hyper/commit/8f93123efef5c1361086688fe4f34c83c89cec02"},{"url":"https://github.com/hyperium/hyper/security/advisories/GHSA-6hfq-h8hq-87mf"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21299"},{"url":"https://github.com/hyperium/hyper"},{"url":"https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn"}],"tags":["osv","rust"],"epss":0.04732,"epssPercentile":0.91804,"ingestedAt":"2026-07-09T18:56:37.284Z","slug":"CVE-2021-21299","body":"## Overview\n\nhyper's HTTP server code had a flaw that incorrectly understands some requests\nwith multiple transfer-encoding headers to have a chunked payload, when it\nshould have been rejected as illegal. This combined with an upstream HTTP proxy\nthat understands the request payload boundary differently can result in\n\"request smuggling\" or \"desync attacks\".\n\n## Affected packages\n\n- `hyper >= 0.14.0-0, < 0.14.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `hyper 0.14.3`","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.9,"exploitation":0,"ransomware":0},"changes":[{"seq":219651,"id":"CVE-2021-21299","ts":1791891968444,"field":"cvss","old":"4.8","new":"8.1"},{"seq":219650,"id":"CVE-2021-21299","ts":1791891968444,"field":"severity","old":"medium","new":"high"}]}