Integer Overflow in Chunked Transfer-Encoding

Vulnerability

An integer overflow flaw exists in the hyper HTTP library for Rust, in versions prior to 0.14.10, during the parsing of chunk sizes in the Transfer-Encoding header. The parser truncates chunk sizes to a 64-bit integer, so a value like f0000000000000003 is interpreted as 3, causing only 3 bytes of the body to be read. This affects both the server and client code when using HTTP/1.1 [1][2][3].

Exploitation

An attacker can craft an HTTP request (or response, in client scenarios) with a Transfer-Encoding: chunked header containing an overly large chunk size, such as f0000000000000003. No authentication or special network position is required beyond the ability to send HTTP messages to a vulnerable hyper endpoint. The exploit requires HTTP/1.1; HTTP/2 is not vulnerable because it does not use chunked encoding. If an upstream proxy allows chunk sizes larger than 64-bit and forwards them to hyper, the attacker can achieve request smuggling [2][3].

Impact

Successful exploitation leads to data loss because hyper reads only a small portion of the intended body. When combined with an upstream proxy that handles chunk sizes differently, this flaw enables HTTP request smuggling or desync attacks, potentially allowing the attacker to inject requests, poison caches, or bypass security controls. The CVSS score is 9.1 (Critical) with high integrity and availability impacts [2].

Mitigation

The vulnerability is patched in hyper version 0.14.10 [1][3]. As a workaround, users can manually reject requests containing a Transfer-Encoding header, or ensure that any upstream proxy rejects chunk sizes larger than what fits in 64-bit unsigned integers [3].