~ / search / GHSA-c8rq-crxj-mj9m

GHSA-c8rq-crxj-mj9m

Async-h1 request smuggling possible with long unread bodies

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-36202

Packages

EcosystemPackageAffectedFixed in
crates.io async-h1 < 2.3.0 2.3.0

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in the async-h1 crate before 2.3.0 for Rust. Request smuggling can occur when used behind a reverse proxy.

References

External links from the advisory. They lead to third-party sites.