GHSA-9xjr-m6f3-v5wm CVE-2016-10932 RUSTSEC-2016-0002

HTTPS MitM vulnerability due to lack of hostname verification

Medium crates.io

Severity: 4.8 / 10; Medium · CVSS 3.0
Exploit chance (EPSS): 0.74%; Chance of exploitation in the next 30 days. Higher than 54.56% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-347 Improper Verification of Cryptographic Signature
Fix: 0.9.4; Upgrade hyper to this version or later

Description

When used on Windows platforms, all versions of Hyper prior to 0.9.4 did not perform hostname verification when making HTTPS requests.

This allows an attacker to perform MitM attacks by preventing any valid CA-issued certificate, even if there's a hostname mismatch.

The problem was addressed by leveraging rust-openssl's built-in support for hostname verification.

Affected versions

crates.io

Package	Vulnerable	Fixed in
hyper	`< 0.9.4`	`0.9.4`
hyper	`>= 0.0.0-0, < 0.9.4`	`0.9.4`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

hyper crates.io → `0.9.4`

cargo

cargo update -p hyper --precise 0.9.4

Severity breakdown

CVSS 3.0 4.8

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack vector: Network
Attack complexity: High
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: None

Weakness

CWE-347: Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2016-10932

Packages

crates.io/crates/hyper

Timeline

May 9, 2016 Published
Feb 4, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-34p9-f4q3-c4r7 Improper Certificate Validation in openssl	High	Linked by the source
GHSA-f67m-9j94-qv9j Parser creates invalid uninitialized value	High	Also affects hyper
GHSA-f3pg-qwvg-p99c Lenient Parsing of Content-Length Header When Prefixed with Plus Sign	Low	Also affects hyper
GHSA-5h46-h7hh-c6x9 Integer Overflow in Chunked Transfer-Encoding	Medium	Also affects hyper
GHSA-6hfq-h8hq-87mf HTTP Request Smuggling in hyper	Medium	Also affects hyper
GHSA-h3qr-rq2j-74w4 HTTP Request Smuggling in hyper	Critical	Also affects hyper
GHSA-q89x-f52w-6hj2 Headers containing newline characters can split messages in hyper	Medium	Also affects hyper
EEF-CVE-2026-65632 ECDSA signature length is not validated in jose, allowing signature malleability	Not rated yet	Same weakness, CWE-347

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor