Skip to main content

actix-files EUVDEUVD-2026-58628

| CVE-2026-72813 MEDIUM
Uncaught Exception (CWE-248)
2026-08-14 VulnCheck GHSA-v47c-94r2-rjm7
Denial Of Service Actix Web Suse
6.9
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Attack requires no auth, no complexity, and no interaction; A:H reflects confirmed full process termination under the documented panic=abort configuration.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 14, 2026 - 13:01 EUVD
Source Code Evidence Fetched
Aug 14, 2026 - 12:41 vuln.today
Analysis Generated
Aug 14, 2026 - 12:41 vuln.today

DescriptionCVE.org

actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header.

AnalysisAI

Remote process termination in actix-files 0.6.9 and earlier allows any unauthenticated network attacker to crash a Rust web server by sending a single GET request with an empty Range header, triggering a panic in the static file handler at named.rs:534. The vulnerability is only catastrophic when the application is compiled with panic = "abort" - the non-default Rust build profile - because in that mode the entire process terminates rather than unwinding the panicking thread. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify actix-files static file endpoint
Delivery
Send GET request with empty Range header
Exploit
HttpRange::parse() returns Ok(vec![])
Execution
Index into empty vector panics at named.rs:534
Persist
panic = abort terminates process
Impact
Server unavailable
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The vulnerability causes significant impact only when the application is compiled with `panic = "abort"` in its Rust build profile (e.g., `[profile.release] panic = "abort"` or `[profile.dev] panic = "abort"` in Cargo.toml) - this is a non-default configuration that developers must explicitly opt into. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms maximum attacker-side ease: no authentication, no complexity, no user interaction, reachable over the network. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker identifies a web service built with actix-files and compiled with `panic = "abort"` - detectable via response headers or binary fingerprinting - and sends a single HTTP GET request to any static file endpoint with a bare `Range:` header containing no value. The server process receives the request, `HttpRange::parse()` returns an empty vector, the handler panics at named.rs:534, and with `panic = "abort"` the entire process terminates instantly, taking down all concurrent connections. …
Remediation Upgrade actix-files to version 0.6.10 or later by updating the dependency in Cargo.toml and running `cargo update`, per the vendor advisory GHSA-gcqf-3g44-vc9p (https://github.com/actix/actix-web/security/advisories/GHSA-gcqf-3g44-vc9p). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Actix Web

View all
CVE-2026-73051 MEDIUM
6.3 Aug 14

HTTP request smuggling in actix-http (versions up to and including 3.12.0) allows unauthenticated remote attackers to de
CVE-2026-72814 MEDIUM
6.3 Aug 14

Path traversal in the actix-files Rust crate (versions 0.6.9 and earlier) exposes arbitrary files from the application's

Same weakness CWE-248 – Uncaught Exception

View all
CVE-2013-10065 HIGH POC
8.7
CVE-2026-62909 HIGH POC
7.8
CVE-2023-0790 HIGH POC
8.8
CVE-2026-53530 HIGH POC
8.7
CVE-2024-8249 HIGH POC
7.5
CVE-2024-8020 HIGH POC
7.5
CVE-2025-59538 HIGH POC
7.5
CVE-2026-34986 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server 16.1 Not-Affected
SUSE Linux Enterprise Server for SAP applications 16.0 Affected
SUSE Linux Enterprise Server for SAP applications 16.1 Not-Affected
openSUSE Leap 16.0 Affected

Share

EUVD-2026-58628 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy