CVE-2021-32715: Lenient Parsing of Content-Length Header When Prefixed with Plus Sign

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-07-07 · updated 2026-06-17
Weakness: CWE-444

Description

hyper is an HTTP library for rust. hyper's HTTP/1 server code had a flaw that incorrectly parses and accepts requests with a `Content-Length` header with a prefixed plus sign, when it should have been rejected as illegal. This combined with an upstream HTTP proxy that doesn't parse such `Content-Length` headers, but forwards them, can result in "request smuggling" or "desync attacks". The flaw exists in all prior versions of hyper prior to 0.14.10, if built with `rustc` v1.5.0 or newer. The vulnerability is patched in hyper version 0.14.10. Two workarounds exist: One may reject requests manually that contain a plus sign prefix in the `Content-Length` header or ensure any upstream proxy handles `Content-Length` headers with a plus sign prefix.

Affected products

hyperium hyper: before 0.14.10 — fixed in 0.14.10
Crates.Io Hyper: from 0.0.0-0 before 0.14.10 — fixed in 0.14.10

How to fix

Upgrade to a fixed version: hyperium hyper 0.14.10; Crates.Io Hyper 0.14.10. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-32715 or the next vulnerability affects your stack