Hyper is a modestly represented but among-the-more-prominent HTTP client and server library ecosystem spanning implementations including the core hyper library, h2 (HTTP/2), and container-runtime components such as hyperstart and runv, where its use in critical network and cloud infrastructure amplifies the significance of its flaws. Vulnerabilities affecting the vendor skew toward serious outcomes and concentrate in protocol-handling and memory-management domains: HTTP request/response smuggling due to inconsistent interpretation of requests, resource-exhaustion conditions, integer overflows, double-free flaws, and CRLF injection in header parsing reflect the parsing and state-management complexity inherent to HTTP implementations. Defenders should inventory downstream consumers of this library ecosystem, particularly container runtimes and reverse proxies, and treat protocol-layer updates as high-priority; live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Hyper over time
Signals from CVEs in this vendor scope (12 CVEs).
12 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-35863CRITICAL An issue was discovered in the hyper crate before 0.12.34 for Rust. HTTP request smuggling can occur. Remote code execution can occur in certain situations with an HTTP server on t | Dec 31, 2020 | 9.8 | 31 | NO | NO |
CVE-2019-25009CRITICAL An issue was discovered in the http crate before 0.1.20 for Rust. The HeaderMap::Drain API can use a raw pointer, defeating soundness. | Dec 31, 2020 | 9.8 | 29 | NO | NO |
CVE-2021-32714CRITICAL hyper is an HTTP library for Rust. In versions prior to 0.14.10, hyper's HTTP server and client code had a flaw that could trigger an integer overflow when decoding chunk sizes tha | Jul 7, 2021 | 9.1 | 27 | NO | NO |
CVE-2021-21299HIGH hyper is an open-source HTTP library for Rust (crates.io). In hyper from version 0.12.0 and before versions 0.13.10 and 0.14.3 there is a vulnerability that can enable a request sm | Feb 11, 2021 | 8.1 | 27 | NO | NO |
CVE-2023-26964HIGH An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STREAM frames. As a result, the memory and CPU usage are high wh | Apr 11, 2023 | 7.5 | 25 | NO | NO |
CVE-2018-9862HIGH util.c in runV 1.0.0 for Docker mishandles a numeric username, which allows attackers to obtain root access by leveraging the presence of an initial numeric value on an /etc/passwd | Apr 9, 2018 | 7.8 | 25 | NO | NO |
CVE-2022-31394HIGH Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform HTTP2 attacks. | Feb 21, 2023 | 7.5 | 24 | NO | NO |
CVE-2020-25574HIGH An issue was discovered in the http crate before 0.1.20 for Rust. An integer overflow in HeaderMap::reserve() could result in denial of service (e.g., an infinite loop). | Sep 14, 2020 | 7.5 | 20 | NO | NO |
CVE-2021-32715MEDIUM hyper is an HTTP library for rust. hyper's HTTP/1 server code had a flaw that incorrectly parses and accepts requests with a `Content-Length` header with a prefixed plus sign, when | Jul 7, 2021 | 5.3 | 19 | NO | NO |
CVE-2017-18587MEDIUM An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers. | Aug 26, 2019 | 5.3 | 18 | NO | NO |
Signals from CVEs in this vendor scope (12 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Hyper.
Media articles that mention a CVE ID that affects a product developed by Hyper — matched by CVE ID, not by vendor name.