CVE-2021-32714: 
Rust vulnerability analysis and mitigation

hyper is an HTTP library for Rust. In versions prior to 0.14.10, hyper's HTTP server and client code contained a vulnerability that could trigger an integer overflow when decoding chunk sizes that are too big. The vulnerability was discovered in July 2021 and assigned CVE-2021-32714 (GitHub Advisory).

The vulnerability occurs in HTTP/1.1 chunked transfer-encoding handling where hyper only reads the rightmost 64-bit integer as the chunk size. For example, in a chunk size like 'f0000000000000003', hyper would only read it as '3'. This limitation can lead to data loss since hyper would only read 3 bytes of the body instead of the full intended size. The issue is classified as CWE-190 (Integer Overflow) (GitHub Advisory).

The vulnerability can result in two types of impacts: 1) Data loss when processing bodies with chunk sizes greater than 18 exabytes, and 2) Potential request smuggling or 'desync attacks' when used with an upstream HTTP proxy that allows chunk sizes larger than hyper does. The vulnerability only affects HTTP/1.1 implementations, as HTTP/2 does not use chunked encoding (GitHub Advisory).

To exploit this vulnerability, an attacker needs to either: 1) Send requests or responses with chunk sizes greater than 18 exabytes to cause data loss, or 2) Use an upstream proxy that allows chunk sizes larger than 64-bit to perform request smuggling attacks. The vulnerability was initially reported by Mattias Grenfeldt and Asta Olofsson (GitHub Advisory).

The vulnerability was patched in version 0.14.10 of hyper. For users unable to upgrade, two workarounds are available: 1) Manually reject requests containing a Transfer-Encoding header, or 2) Ensure any upstream proxy rejects Transfer-Encoding chunk sizes greater than what fits in 64-bit unsigned integers (GitHub Advisory).