RUSTSEC-2020-0008: 
Rust vulnerability analysis and mitigation

An HTTP request smuggling vulnerability was discovered in the Hyper crate versions prior to 0.12.34 for Rust, identified as RUSTSEC-2020-0008 (CVE-2020-35863). The vulnerability was disclosed on December 31, 2020, affecting the Hyper HTTP library implementation in Rust (NVD).

The vulnerability stems from incorrect handling of transfer-encoding headers in HTTP requests, particularly in GET requests where the transfer-encoding headers were being wrongly stripped. This implementation flaw could lead to HTTP request smuggling vulnerabilities. The severity of this vulnerability is rated as CRITICAL with a CVSS v3.1 Base Score of 9.8 (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) (NVD).

The vulnerability could potentially lead to remote code execution in specific scenarios, particularly when an HTTP server is running on the loopback interface. The high CVSS score indicates that the vulnerability can result in complete compromise of system confidentiality, integrity, and availability (NVD).

Users are advised to upgrade to Hyper version 0.12.34 or later, which contains the patch for this vulnerability (NVD).