Skip to content
← Vulnerability catalog
OFFICIAL CVE RECORD6.3 Medium

CVE-2026-73051

actix-http before 3.12.1 HTTP Request Smuggling via CL.TE

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through a front-end intermediary to desynchronize backend requests and smuggle malicious HTTP requests to the Actix service.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

actix actix-http

Default version status: unaffected

  • 0 to < 3.12.1affected
  • 3.12.1unaffected
pkg:cargo/actix-http

References