CVE-2020-36202

The async-h1 crate for Rust contains a request smuggling vulnerability (CVE-2020-36202) that affects versions prior to 2.3.0. The root cause lies in how the server handles HTTP request bodies: if the server does not read the body of a request longer than a specific buffer length, async-h1 will interpret the subsequent bytes as a new request, leading to smuggling [1][3].

Exploitation occurs when async-h1 is deployed behind a reverse proxy. An attacker can craft a request whose body contains a second, malicious request. The reverse proxy may not detect the smuggled request, allowing the attacker to forge headers like X-Forwarded-For. In keep-alive connections, the smuggled request can specify a long Content-Length to capture another user's request in its body [3].

The impact is significant: an attacker can inject arbitrary headers, potentially bypassing security controls or impersonating users. They may also steal sensitive data from other requests, as the smuggled request can capture and expose their content [1][3].

Mitigation is straightforward: upgrade to async-h1 version 2.3.0 or later, which fixes the issue. All prior versions have been yanked from crates.io to prevent further use. Users of Tide web framework (which depends on async-h1) should also update their dependencies [1][3].