{"id":"CVE-2017-18587","aliases":["EUVD-2021-1836","GHSA-q89x-f52w-6hj2","RUSTSEC-2017-0002"],"status":"published","title":"Headers containing newline characters can split messages in hyper","description":"An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01033,"percentile":0.6397,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-93"],"published":"2017-01-23T12:00:00Z","modified":"2026-10-24T10:31:03Z","fixes":[{"ecosystem":"crates.io","package":"hyper","fixed_in":["0.10.2","0.9.18"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"hyper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.0"},{"fixed":"0.10.2"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"hyper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.18"}]}]},{"source":"osv","ecosystem":"crates.io","package":"hyper","ranges":[{"type":"SEMVER","events":[{"introduced":"0.10.0"},{"fixed":"0.10.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"hyper","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.9.18"}]}]},{"source":"osv","ecosystem":"crates.io","package":"hyper","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.9.18"},{"introduced":"0.10.0"},{"fixed":"0.10.2"}]}]}],"products":[{"vendor":"hyper","product":"hyper"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2017-0002.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18587","tags":["advisory"]},{"url":"https://github.com/hyperium/hyper/wiki/Security-001","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q89x-f52w-6hj2"},{"url":"https://github.com/hyperium/hyper","tags":["package"]},{"url":"https://crates.io/crates/hyper","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2017-18587","description":"An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers.","status":"published","published":"2019-08-26T12:05:05Z","modified":"2024-08-05T21:28:55.46Z","updated_at":"2026-11-02T14:33:21.747294Z"}],"euvd":[{"id":"EUVD-2021-1836","description":"An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers.","status":"published","published":"2019-08-26T12:05:05Z","modified":"2024-08-05T21:28:55Z","updated_at":"2026-11-03T02:23:05.586343Z"}],"ghsa":[{"id":"GHSA-q89x-f52w-6hj2","title":"Headers containing newline characters can split messages in hyper","description":"Serializing of headers to the socket did not filter the values for newline bytes (\\r or \\n), which allowed for header values to split a request or response. People would not likely include newlines in the headers in their own applications, so the way for most people to exploit this is if an application constructs headers based on unsanitized user input.\n\nThis issue was fixed by replacing all newline characters with a space during serialization of a header value.","status":"published","published":"2021-08-25T20:43:04Z","modified":"2023-06-13T17:39:47Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:36:53.654352Z"}],"nvd":[{"id":"CVE-2017-18587","description":"An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers.","status":"published","published":"2019-08-26T13:15:10.993Z","modified":"2026-06-17T01:13:08.933Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:04:20.074898Z"}],"osv":[{"id":"CVE-2017-18587","description":"An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers.","status":"published","published":"2019-08-26T13:15:10.993Z","modified":"2026-10-24T10:31:03.59187815Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:05.486486Z"},{"id":"GHSA-q89x-f52w-6hj2","title":"Headers containing newline characters can split messages in hyper","description":"Serializing of headers to the socket did not filter the values for newline bytes (\\r or \\n), which allowed for header values to split a request or response. People would not likely include newlines in the headers in their own applications, so the way for most people to exploit this is if an application constructs headers based on unsanitized user input.\n\nThis issue was fixed by replacing all newline characters with a space during serialization of a header value.","status":"published","published":"2021-08-25T20:43:04Z","modified":"2023-11-08T03:59:16.284067Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T15:46:54.40888Z"},{"id":"RUSTSEC-2017-0002","title":"headers containing newline characters can split messages","description":"Serializing of headers to the socket did not filter the values for newline bytes (`\\r` or `\\n`),\nwhich allowed for header values to split a request or response. People would not likely include\nnewlines in the headers in their own applications, so the way for most people to exploit this\nis if an application constructs headers based on unsanitized user input.\n\nThis issue was fixed by replacing all newline characters with a space during serialization of\na header value.","status":"published","published":"2017-01-23T12:00:00Z","modified":"2023-11-08T03:59:16.284067Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:39.492624Z"}]}}