Threats tagged 'ghsa-5hc2-r3jq-vc45'

The rust-tiny-http library through version 0.12.0 contains an HTTP request smuggling vulnerability. This flaw allows remote attackers to desynchronize request framing by sending a Transfer-Encoding header with any value, including non-chunked codings. The library improperly applies chunk-decoding and discards Content-Length, leading to discrepancies with front-end proxies that correctly implement Transfer-Encoding parsing. This can enable request smuggling and cause failed body reads that tie up connections and consume worker threads without signaling errors to clients.