CVE-2021-32715

hyper is an HTTP library for rust. hyper's HTTP/1 server code had a flaw that incorrectly parses and accepts requests with a `Content-Length` header with a prefixed plus sign, when it should have been rejected as illegal. This combined with an upstream HTTP proxy that doesn't parse such `Content-Length` headers, but forwards them, can result in "request smuggling" or "desync attacks". The flaw exists in all prior versions of hyper prior to 0.14.10, if built with `rustc` v1.5.0 or newer. The vulnerability is patched in hyper version 0.14.10. Two workarounds exist: One may reject requests manually that contain a plus sign prefix in the `Content-Length` header or ensure any upstream proxy handles `Content-Length` headers with a plus sign prefix.

• CWE-444
• CWE-444

• https://github.com/hyperium/hyper/security/advisories/GHSA-f3pg-qwvg-p99cExploit, Third Party Advisory
• https://github.com/rust-lang/rust/pull/28826/commits/123a83326fb95366e94a3be1a74775df4db97739Patch, Third Party Advisory
• https://github.com/hyperium/hyper/security/advisories/GHSA-f3pg-qwvg-p99cExploit, Third Party Advisory
• https://github.com/rust-lang/rust/pull/28826/commits/123a83326fb95366e94a3be1a74775df4db97739Patch, Third Party Advisory

Published

Jul 7, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-3271PressBooks 5.17.3 contains a cross-site scripting (XSS). Sto…4.8
• CVE-2021-32710Shopware is an open source eCommerce platform. Potential ses…7.5
• CVE-2021-32711Shopware is an open source eCommerce platform. Versions prio…7.5
• CVE-2021-32712Shopware is an open source eCommerce platform. Versions prio…5.3
• CVE-2021-32713Shopware is an open source eCommerce platform. Versions prio…4.8
• CVE-2021-32714hyper is an HTTP library for Rust. In versions prior to 0.14…9.1
• CVE-2021-32716Shopware is an open source eCommerce platform. In versions p…4.9
• CVE-2021-32717Shopware is an open source eCommerce platform. In versions p…7.5
• CVE-2021-32718RabbitMQ is a multi-protocol messaging broker. In rabbitmq-s…5.4
• CVE-2021-32719RabbitMQ is a multi-protocol messaging broker. In rabbitmq-s…4.8
• CVE-2021-3272jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 ha…5.5
• CVE-2021-32720Sylius is an Open Source eCommerce platform on top of Symfon…5.3