What’s Vulnerable › Vulnerabilities

CVE-2020-35884

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-12-31 · updated 2026-06-17
• Weakness: CWE-444

Description

An issue was discovered in the tiny_http crate through 2020-06-16 for Rust. HTTP Request smuggling can occur via a malformed Transfer-Encoding header.

Affected products

• Fedoraproject Fedora: 34, 35
• HackerOne tiny-http node module: through 0.7.0

References

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M3JDNRE5RXJOWZZZF5QSCG4GUCSLTHF2/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VO6SRTCEPEYO2OX647I3H5XUWLFDRDWL/
• https://rustsec.org/advisories/RUSTSEC-2020-0031.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M3JDNRE5RXJOWZZZF5QSCG4GUCSLTHF2/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VO6SRTCEPEYO2OX647I3H5XUWLFDRDWL/
• https://rustsec.org/advisories/RUSTSEC-2020-0031.html

Get alerted when CVE-2020-35884 or the next vulnerability affects your stack