Cloudflare 修復 hyper HTTP/1 競態條件

💡你的 Rust AI 服務若使用 hyper，HTTP/1 競態條件可能需要立即修補。

⚡ 30-Second TL;DR

What Changed

問題位於 hyper 的 HTTP/1 實作

Why It Matters

若服務依賴受影響的 hyper 版本，並行 HTTP 流量可能帶來可靠性或安全風險。AI API 閘道、模型服務與內部微服務若採用該元件，也應將此修復納入依賴管理流程。

What To Do Next

立即掃描 Rust 專案的 hyper 相依版本，對照上游修復公告升級至已修正版，並在 CI 中加入相依漏洞掃描。

Who should care:Developers & AI Engineers

AI-generated analysis for this event.

•The vulnerability was identified as a race condition specifically within the hyper crate's HTTP/1 server implementation, potentially leading to request smuggling or data corruption.
•Cloudflare's engineering team contributed the fix directly to the upstream hyper repository, demonstrating their active role in maintaining the Rust ecosystem's core infrastructure.
•The issue primarily affected high-concurrency environments where multiple tasks might attempt to manipulate the same connection state simultaneously during HTTP/1 keep-alive processing.
•The fix involved refining the state machine logic within hyper to ensure atomic transitions when handling connection polling and request lifecycle management.
•This incident highlights the critical dependency of major global AI and web infrastructure providers on the hyper library, which serves as the de facto standard for HTTP in Rust.

The race condition occurred during the transition between the 'Idle' and 'Busy' states of an HTTP/1 connection.
Specifically, a race existed between the task polling the connection for new requests and the task responsible for flushing the response buffer.
The fix implemented stricter synchronization primitives, ensuring that the connection state cannot be mutated by concurrent tasks during the transition period.
The patch ensures that the internal state machine correctly handles 'Connection: keep-alive' headers by preventing overlapping read/write operations on the underlying stream.