A vulnerability in the httpsig-hyper crate for Rust allows unauthenticated attackers to bypass HTTP message integrity checks due to an incorrect comparison logic flaw.

This vulnerability occurs due to the improper use of the Rust matches! macro, which causes the Digest header verification to treat expected values as patterns rather than comparisons. An unauthenticated attacker can supply a malformed HTTP message body that bypasses integrity validation, as the library incorrectly reports success even when the digest does not match.

Successful exploitation of this vulnerability permits an attacker to modify HTTP message bodies without detection by the application. Because the integrity of the message is compromised, the application may process malicious or unauthorized data, leading to potential data corruption or unauthorized state changes. With a CVSS score of 7.5, this high severity flaw poses a significant risk to the reliability and security of any system relying on the library for secure communication.

Immediate Action: Update the httpsig-hyper crate to version 0.0.23 or later to incorporate the corrected value comparison and constant-time verification logic.

Proactive Monitoring: Review application logs for unusual HTTP traffic patterns or message bodies that might indicate attempts to manipulate request integrity.

Compensating Controls: Implement additional application-level integrity checks or utilize robust transport-layer security (TLS) configurations to minimize the reliance on individual header-based digest verification.

Public Exploit Available: Unknown

The vulnerability represents a critical failure in the library security mechanism that ensures data integrity. Organizations utilizing the httpsig-hyper crate must prioritize upgrading to version 0.0.23 immediately to restore the integrity of their HTTP signature validations. Failure to patch this dependency leaves the affected applications susceptible to sophisticated message-tampering attacks.