CVE-2020-26281: 
Rust vulnerability analysis and mitigation

async-h1 is an asynchronous HTTP/1.1 parser for Rust (crates.io). A request smuggling vulnerability was discovered in async-h1 versions before 2.3.0, disclosed on December 21, 2020. The vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all Tide applications (GitHub Advisory, NVD).

The vulnerability occurs when the server does not read the body of a request that is longer than a specific buffer length. In such cases, async-h1 will attempt to read a subsequent request from within the body content starting at that offset into the body. This behavior allows for HTTP request smuggling attacks. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N (NVD).

An attacker could craft a request containing a second request in its body that would not be detected by a reverse proxy, enabling the forging of forwarded/x-forwarded headers. Additionally, if a reverse proxy sends multiple HTTP clients' requests along the same keep-alive connection, an attacker could capture another user's request in the body of a smuggled request. The captured content could then be retrieved through a POST request to a specific endpoint (GitHub Advisory).

The vulnerability requires crafting specific HTTP requests with carefully constructed body content. The attack can be executed remotely without requiring authentication or user interaction, though it requires a high level of technical complexity to exploit successfully (NVD).

The vulnerability has been fixed in async-h1 version 2.3.0. All previous versions have been yanked from crates.io due to the severity of the vulnerability. There are no known workarounds, and users are strongly advised to upgrade to version 2.3.0 (GitHub Release).