We found a bug in the hyper HTTP library
Cloudflare discovered a vulnerability in the hyper HTTP library, affecting HTTP/2 parsing. The bug could lead to denial of service or potential data exposure. Cloudflare worked with the maintainers to fix the issue.
Background
- Cloudflare is a major tech company that provides content-delivery-network (CDN) and web-security services, handling a significant portion of global internet traffic.
- The "hyper HTTP library" is a low-level, high-performance Rust-language library for handling the HTTP protocol. It is widely used as a building block in many modern networking tools and services (including parts of Cloudflare's own infrastructure).
- The post describes a subtle bug Cloudflare discovered in hyper, related to how it interprets certain HTTP trailers (extra headers sent after a response body). This could cause a server to misread request boundaries and potentially lead to request smuggling (a security vulnerability where an attacker can trick a server and client into interpreting the boundaries between HTTP requests differently, potentially hijacking other users' requests).
- Cloudflare responsibly disclosed the bug to the hyper maintainers, who quickly issued a fixed version. The post offers technical details of the bug, how it was found, and mitigation advice for users of the affected library.