RUSTSEC-2020-0031: HTTP Request smuggling through malformed Transfer Encoding headers

[github-actions]

HTTP Request smuggling through malformed Transfer Encoding headers

Details
Package	tiny_http
Version	0.6.2
URL	tiny-http/tiny-http#173
Date	2020-06-16

HTTP pipelining issues and request smuggling attacks are possible due to incorrect
Transfer encoding header parsing.

It is possible conduct HTTP request smuggling attacks (CL:TE/TE:TE) by sending invalid Transfer Encoding headers.

By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information
from requests other than their own.

See advisory page for additional details.

[jolestar]

wait tiny-http/tiny-http#173