CVE-2017-18587
Headers containing newline characters can split messages in hyper
CVE-2017-18587 is a medium vulnerability (CVSS 5.3) in Hyper, published January 23, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.03%, the 64th percentile. Fixed in hyper 0.10.2.
- Severity
- 5.3 MediumCVSS 3.0, NVD
- Exploit chance
- 1.03%EPSS, 64th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.10.2hyper +2 more
Description
An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
Affected products
Affected packages
What each source reports
NVD Score used
An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers.
- Record
CVE-2017-18587- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-93
- Updated
- 2026-11-02
CVE ListNo score
An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers.
- Record
CVE-2017-18587- Updated
- 2026-11-02
EUVDEUVD-2021-1836No score
An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers.
- Record
EUVD-2021-1836- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q89x-f52w-6hj2
Headers containing newline characters can split messages in hyper
Serializing of headers to the socket did not filter the values for newline bytes (\r or \n), which allowed for header values to split a request or response. People would not likely include newlines in the headers in their own applications, so the way for most people to exploit this is if an application constructs headers based on unsanitized user input.
This issue was fixed by replacing all newline characters with a space during serialization of a header value.
- Record
GHSA-q89x-f52w-6hj2- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-93
- Updated
- 2026-11-02
OSV
An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers.
- Record
CVE-2017-18587- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-q89x-f52w-6hj2
Headers containing newline characters can split messages in hyper
Serializing of headers to the socket did not filter the values for newline bytes (\r or \n), which allowed for header values to split a request or response. People would not likely include newlines in the headers in their own applications, so the way for most people to exploit this is if an application constructs headers based on unsanitized user input.
This issue was fixed by replacing all newline characters with a space during serialization of a header value.
- Record
GHSA-q89x-f52w-6hj2- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-93
- Updated
- 2026-11-02
OSVRUSTSEC-2017-0002
headers containing newline characters can split messages
Serializing of headers to the socket did not filter the values for newline bytes (\r or \n),
which allowed for header values to split a request or response. People would not likely include
newlines in the headers in their own applications, so the way for most people to exploit this
is if an application constructs headers based on unsanitized user input.
This issue was fixed by replacing all newline characters with a space during serialization of a header value.
- Record
RUSTSEC-2017-0002- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.