EUVD-2026-58619
GHSA-rh8q-rpf9-79v6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects mandatory CL.TE proxy topology; S:C and C:L/I:L capture cross-user request desynchronization affecting other backend sessions.
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through a front-end intermediary to desynchronize backend requests and smuggle malicious HTTP requests to the Actix service.
AnalysisAI
HTTP request smuggling in actix-http (versions up to and including 3.12.0) allows unauthenticated remote attackers to desynchronize backend request parsing when the service operates behind an HTTP/1.1 intermediary. The parser accepted requests carrying both Content-Length and Transfer-Encoding: chunked headers (the CL.TE variant) and silently selected chunked decoding instead of rejecting the ambiguous framing as required by RFC 7230, enabling an attacker to prepend malicious content to subsequent backend requests. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a CL.TE proxy topology: a front-end intermediary (reverse proxy, WAF, CDN edge node, or load balancer) must be present, must forward HTTP/1.1 requests containing both Content-Length and Transfer-Encoding: chunked without rejection, and must reuse persistent backend connections to the Actix service. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 6.3 with vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N reflects the core tension of this vulnerability: the attack requires no authentication and no user interaction (PR:N, UI:N) but mandates a very specific intermediary topology (AT:P), which meaningfully constrains the real-world attacker population. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker aware that a target site runs actix-web behind a load balancer or WAF crafts an HTTP/1.1 POST request with a Content-Length of 50 and a Transfer-Encoding: chunked body that terminates with a 0-byte chunk followed by a complete second HTTP request prefix. The front-end proxy reads 50 bytes per Content-Length and forwards the entire payload on a reused backend connection; the Actix parser consumes the chunked body and then reads the appended bytes as a fresh request, effectively injecting a request prefix that will be prepended to the next legitimate user request processed on that connection. … |
| Remediation | The primary fix is to upgrade actix-http to version 3.12.1 or later; this version rejects HTTP/1.1 requests containing both Content-Length and Transfer-Encoding: chunked headers rather than silently selecting chunked decoding. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote process termination in actix-files 0.6.9 and earlier allows any unauthenticated network attacker to crash a Rust
Path traversal in the actix-files Rust crate (versions 0.6.9 and earlier) exposes arbitrary files from the application's
Same weakness CWE-444 – HTTP Request/Response Smuggling
View allSame technique Request Smuggling
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Micro 5.3 | Affected |
| SUSE Linux Enterprise Micro 5.4 | Affected |
| SUSE Linux Enterprise Micro 5.5 | Affected |
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Micro 6.0 | Affected |
| SUSE Linux Micro 6.1 | Affected |
| SUSE Linux Micro 6.2 | Affected |
| openSUSE Leap 16.0 | Affected |
| openSUSE Leap 16.0 | Affected |
| openSUSE Leap Micro 5.3 | Affected |
| openSUSE Leap Micro 5.4 | Affected |
| openSUSE Leap Micro 5.5 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today