actix-files CVE-2026-72813

The vulnerability causes significant impact only when the application is compiled with panic = "abort" in its Rust build profile (e.g., [profile.release] panic = "abort" or [profile.dev] panic = "abort" in Cargo.toml) - this is a non-default configuration that developers must explicitly opt into. The attacker must be able to send a GET request to any endpoint that serves static files via actix-files (i.e., the application must expose actix_files::NamedFile or actix_files::Files). No authentication is required (CVSS PR:N). Applications compiled with the default panic = "unwind" are not significantly affected: the panicking worker thread unwinds, the connection closes, and new worker threads are spawned, making the impact limited to the single affected request. Rate limiting does not reliably prevent exploitation since a single unblocked request suffices to crash the process.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms maximum attacker-side ease: no authentication, no complexity, no user interaction, reachable over the network. The provided score uses VA:L (low availability impact to the vulnerable system), which reflects that most Rust applications use the default panic = "unwind" profile. However, the actual impact on applications compiled with panic = "abort" is a complete and immediate process termination from a single request - a real priority for any such deployment. No EPSS data was provided, preventing probabilistic exploitation comparison. The CVE is not listed in CISA KEV at time of analysis. A working PoC is embedded directly in the vendor advisory and requires only netcat, meaning exploitation friction is essentially zero for discoverable endpoints. The rate-limiting note in the advisory is significant: since a single request suffices, conventional rate limiting cannot reliably prevent this - it merely narrows the exploit window. Real-world priority is medium-to-high specifically for services compiled with panic = "abort" and low for standard builds.

An attacker identifies a web service built with actix-files and compiled with panic = "abort" - detectable via response headers or binary fingerprinting - and sends a single HTTP GET request to any static file endpoint with a bare Range: header containing no value. The server process receives the request, HttpRange::parse() returns an empty vector, the handler panics at named.rs:534, and with panic = "abort" the entire process terminates instantly, taking down all concurrent connections. A working PoC demonstrating this with netcat is publicly available in the GHSA advisory.