This vulnerability arises from the misuse of Rust’s matches! macro in the httpsig-hyper library, where the digest comparison was written as if matches!(digest, _expected_digest). The macro interprets the right‑hand side as a pattern binding rather than a value, causing the condition to succeed unconditionally. Consequently, the library reports successful digest verification even when the computed digest does not match the expected value, allowing an attacker to modify the HTTP message body without detection. The weakness relates to improper authentication logic and signature parsing, identified as CWE‑354 and CWE‑697.

Affected versions are all releases of httpsig-hyper prior to 0.0.23, which is distributed by the Rust crate httpsig‑rs from the vendor junkurihara. Any application that incorporates this hyper extension for HTTP message signatures without applying additional integrity checks is vulnerable. The issue applies to HTTP traffic handled via Hyper and any client or server code that relies solely on the Digest header verification provided by this library.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1 % suggests a low likelihood of active exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, meaning no known public exploits have been reported. The attack vector is inferred to be remote, as an attacker can craft HTTP requests or responses during transit to trigger the digest bypass. The impact of exploitation would be the undetected alteration of message content, potentially leading to unauthorized actions or data tampering. However, because the vulnerability remains unpatched in older versions, remediation remains a high priority.