Rust advisories / async-h1
Vulnerability MediumRUSTSEC-2020-0093 · async-h1
RUSTSEC-2020-0093: Async-h1 request smuggling possible with long unread bodies
Short answerA security vulnerability in the async-h1 crate: Async-h1 request smuggling possible with long unread bodies. GitHub rates it Medium. Fixed in 2.3.0: update to a fixed version.
| Crate | async-h1 |
|---|---|
| Type | Vulnerability |
| Affected versions | Before 2.3.0. |
| Fixed in | 2.3.0 |
| Severity | Medium (GitHub rating) |
| Published | 2020-12-17 |
| Last changed | 2023-11-08 |
| Also known as | CVE-2020-26281, CVE-2020-36202, GHSA-4vr9-8cjf-vf9c, GHSA-c8rq-crxj-mj9m |
| Affected functions | async_h1::server::accept, async_h1::server::decode |
What to do
- See which version you have:
cargo tree -i async-h1(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p async-h1. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for exampleasync-h1 = "2.3.0") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applications.
If the server does not read the body of a request which is longer than some buffer length, async-h1 will attempt to read a subsequent request from the body content starting at that offset into the body.
One way to exploit this vulnerability would be for an adversary to craft a request such that the body contains a request that would not be noticed by a reverse proxy, allowing it to forge forwarded/x-forwarded headers. If an application trusted the authenticity of these headers, it could be misled by the smuggled request.
Another potential concern with this vulnerability is that if a reverse proxy is sending multiple http clients' requests along the same keep-alive connection, it would be possible for the smuggled request to specify a long content and capture another user's request in its body. This content could be captured in a post request to an endpoint that allows the content to be subsequently retrieved by the adversary.
The flaw was corrected in commit 7df79f by ensuring that the request body is always consumed from the tcp stream before attempting to read subsequent keep-alive request headers from it.
References
- Package: crates.io/crates/async-h1
- Advisory: rustsec.org/advisories/RUSTSEC-2020-0093.html
- Web: github.com/http-rs/async-h1/releases/tag/v2.3.0
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?