Request Smuggling Vulnerability in Async-H1 Crate by Rust
CVE-2020-36202

6.1MEDIUM

Key Information:

Vendor

Rust-lang
Status
Async-h1
Vendor
CVE Published:
26 January 2021

What is CVE-2020-36202?

A potential request smuggling issue has been identified in the async-h1 crate prior to version 2.3.0. This vulnerability can be exploited when the crate is used behind a reverse proxy, leading to potential security risks. Developers using this crate should ensure they are using an updated version to mitigate such vulnerabilities.

References

https://rustsec.org/advisories/RUSTSEC-2020-0093.html
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
The Cyber Security Vulnerability Database.