We found a bug in the hyper HTTP library
Cloudflare discovered a bug in the popular hyper HTTP library that could allow request smuggling attacks. The flaw, dubbed "hyper-bug," affects applications using hyper and was responsibly disclosed and patched. Cloudflare implemented a mitigation in its own infrastructure to protect customers.
Background
- Cloudflare is a major internet infrastructure company that provides CDN, DDoS protection, and security services for websites. They process a significant portion of global web traffic.
- Hyper is a widely-used open-source HTTP library written in the Rust programming language. It's considered a foundational piece of Rust's web ecosystem.
- Cloudflare relies heavily on Rust and the hyper library for key services that handle HTTP traffic, including their edge proxy and other performance-critical systems.
- The article describes a subtle memory safety bug Cloudflare found in hyper's HTTP/1 parsing code. While Rust is known for preventing memory bugs, this bug involved complex async logic that Rust's safety checks don't fully catch — a nuanced edge case.
- The bug could cause the server to misinterpret headers under concurrent request conditions, potentially leading to request smuggling or data corruption.
- Cloudflare reported the bug to the hyper maintainers, a fix was released, and Cloudflare urges users to update. The post highlights the ongoing challenge of correctness even in memory-safe languages like Rust.