Cloudflare discovers and fixes race condition bug affecting hyper HTTP library across multiple major versions
Tags OSS · Infrastructure · Security
Cloudflare engineers spent six weeks debugging an intermittent race condition in the open-source hyper HTTP library (Rust) that caused image responses to be silently truncated. The bug, present in hyper versions 0.14 through 1.8, only manifested under specific production conditions: when the reader on the other end of a Unix socket consumed data slower than hyper could write to the kernel buffer, hyper would issue a premature socket shutdown, cutting off response data. The issue was fixed with four lines of code. Cloudflare encountered the bug after rearchitecting its Images binding from network sockets to Unix sockets for lower latency in December 2025.
Technical significance
This bug affected every service using hyper with Unix socket connections — a pattern increasingly common in service mesh and sidecar architectures. The silent truncation (HTTP 200 with incomplete body) is particularly dangerous because it bypasses typical error handling. Any Rust service using hyper for local IPC should verify they have the patched version, as this class of bug can cause data corruption without obvious failure signals.