---
id: CVE-2021-21299
aliases:
  - RUSTSEC-2021-0020
  - GHSA-6hfq-h8hq-87mf
title: Multiple Transfer-Encoding headers misinterprets request payload
summary: Multiple Transfer-Encoding headers misinterprets request payload
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: hyper
product: hyper
ecosystem: rust
affected:
  - 'hyper >= 0.14.0-0, < 0.14.3'
patched:
  - hyper 0.14.3
published: '2021-02-05'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T18:00:04.410731844Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2021-0020'
references:
  - url: 'https://crates.io/crates/hyper'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2021-0020.html'
  - url: >-
      https://github.com/hyperium/hyper/commit/8f93123efef5c1361086688fe4f34c83c89cec02
  - url: 'https://github.com/hyperium/hyper/security/advisories/GHSA-6hfq-h8hq-87mf'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-21299'
  - url: 'https://github.com/hyperium/hyper'
  - url: >-
      https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn
tags:
  - osv
  - rust
epss: 0.04732
epssPercentile: 0.91804
ingestedAt: '2026-07-09T18:56:37.284Z'
---

## Overview

hyper's HTTP server code had a flaw that incorrectly understands some requests
with multiple transfer-encoding headers to have a chunked payload, when it
should have been rejected as illegal. This combined with an upstream HTTP proxy
that understands the request payload boundary differently can result in
"request smuggling" or "desync attacks".

## Affected packages

- `hyper >= 0.14.0-0, < 0.14.3`

## Remediation

Upgrade to a patched release:

- `hyper 0.14.3`