GHSA-7v2r-wxmg-mgvcMediumCVSS 6.5

HTTP Request smuggling in tiny_http

Published
August 25, 2021
Last Modified
June 13, 2023

🔗 CVE IDs covered (1)

📋 Description

HTTP pipelining issues and request smuggling attacks are possible due to incorrect Transfer encoding header parsing. It is possible conduct HTTP request smuggling attacks (CL:TE/TE:TE) by sending invalid Transfer Encoding headers. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own.

🎯 Affected products1

  • rust/tiny_http:< 0.8.0

🔗 References (8)