7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26275

CVE-2026-26275: httpsig-hyper has Improper Digest Verification that May Allow Message Integrity Bypass

httpsig-hyper is a hyper extension for http message signatures. An issue was discovered in httpsig-hyper prior to version 0.0.23 where Digest header verification could incorrectly succeed due to misuse of Rust's matches! macro. Specifically, the comparison if matches!(digest, _expected_digest) treated _expected_digest as a pattern binding rather than a value comparison, resulting in unconditional success of the match expression. As a consequence, digest verification could incorrectly return success even when the computed digest did not match the expected value. Applications relying on Digest verification as part of HTTP message signature validation may therefore fail to detect message body modification. The severity depends on how the library is integrated and whether additional signature validation layers are enforced. This issue has been fixed in httpsig-hyper 0.0.23. The fix replaces the incorrect matches! usage with proper value comparison and additionally introduces constant-time comparison for digest verification as defense-in-depth. Regression tests have also been added to prevent reintroduction of this issue. Users are strongly advised to upgrade to the patched version. There is no reliable workaround without upgrading. Users who cannot immediately upgrade should avoid relying solely on Digest verification for message integrity and ensure that full HTTP message signature verification is enforced at the application layer.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-26275

CVE-2026-26275:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
httpsig-hyper	rust	< 0.0.23	0.0.23

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the misuse of Rust's matches! macro within the verify_content_digest function for both HTTP requests (HyperRequestDigest) and responses (HyperResponseDigest). The code intended to compare a computed digest with an expected digest from the Content-Digest header. However, the line if matches!(digest, _expected_digest) does not perform a value comparison. Instead, because _expected_digest starts with an underscore, it is treated as a wildcard pattern that binds to any value. Consequently, the check always returned true, effectively disabling the digest verification and allowing modified message bodies to pass validation. The patch in commit 65cbd19b395180a4bba09a89746c4b14ccb8d297 corrects this logical flaw by replacing the matches! macro with a direct equality comparison (digest == _expected_digest). A subsequent commit (5533f596c650377e02f4aa9e3eb8dba591b87370) further hardens the fix by implementing a constant-time comparison to prevent potential timing attacks.

Vulnerable functions

HyperRequestDigest::verify_content_digest

httpsig-hyper/src/hyper_content_digest.rs

The function uses the `matches!` macro incorrectly for digest verification. The variable `_expected_digest` is treated as a pattern binding that matches anything, rather than a value to be compared against. This causes the digest verification to always succeed, allowing an attacker to bypass message integrity checks.

HyperResponseDigest::verify_content_digest

httpsig-hyper/src/hyper_content_digest.rs

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.