---
id: CVE-2021-32714
aliases:
  - RUSTSEC-2021-0079
  - GHSA-5h46-h7hh-c6x9
title: >-
  Integer overflow in `hyper`'s parsing of the `Transfer-Encoding` header leads
  to data loss
summary: >-
  Integer overflow in `hyper`'s parsing of the `Transfer-Encoding` header leads
  to data loss
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'
vendor: hyper
product: hyper
ecosystem: rust
affected:
  - 'hyper >= 0.0.0-0, < 0.14.10'
patched:
  - hyper 0.14.10
published: '2021-07-07'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T18:00:02.671544457Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2021-0079'
references:
  - url: 'https://crates.io/crates/hyper'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2021-0079.html'
  - url: >-
      https://github.com/hyperium/hyper/commit/efd9a9821fd2f1ae04b545094de76a435b62e70f
  - url: 'https://github.com/hyperium/hyper/security/advisories/GHSA-5h46-h7hh-c6x9'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-32714'
  - url: 'https://github.com/hyperium/hyper'
tags:
  - osv
  - rust
epss: 0.01155
epssPercentile: 0.66852
ingestedAt: '2026-07-09T18:56:37.276Z'
---

## Overview

When decoding chunk sizes that are too large, `hyper`'s code would encounter an integer overflow. Depending on the situation,
this could lead to data loss from an incorrect total size, or in rarer cases, a request smuggling attack.

To be vulnerable, you must be using `hyper` for any HTTP/1 purpose, including as a client or server, and consumers must send
requests or responses that specify a chunk size greater than 18 exabytes. For a possible request smuggling attack to be possible,
any upstream proxies must accept a chunk size greater than 64 bits.

## Affected packages

- `hyper >= 0.0.0-0, < 0.14.10`

## Remediation

Upgrade to a patched release:

- `hyper 0.14.10`