AIKIDO-2026-931565
hyper is vulnerable to HTTP Request Smuggling
54
Medium Risk
This Affects:
hyperTL;DR
hyper's HTTP/1 server parser keeps a Content-Length header on a request that also carries Transfer-Encoding whenever the Content-Length field appears first on the wire, and it leaves the connection open after responding. When hyper is used as an intermediary and forwards such a request, a downstream recipient that trusts the stale Content-Length can disagree on where the message body ends. This mismatch enables request smuggling or response splitting against the downstream. The fix discards the overridden Content-Length header and closes the connection as required by RFC 9112.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and are using hyper as an HTTP/1 server that forwards requests to a downstream recipient.
Background info
hyper is vulnerable to HTTP Request Smuggling in versions 1.0.0 - 1.10.1.
How to fix this
Upgrade the hyper library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.