Actix
Monthly
HTTP request smuggling in actix-http (versions up to and including 3.12.0) allows unauthenticated remote attackers to desynchronize backend request parsing when the service operates behind an HTTP/1.1 intermediary. The parser accepted requests carrying both Content-Length and Transfer-Encoding: chunked headers (the CL.TE variant) and silently selected chunked decoding instead of rejecting the ambiguous framing as required by RFC 7230, enabling an attacker to prepend malicious content to subsequent backend requests. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Path traversal in the actix-files Rust crate (versions 0.6.9 and earlier) exposes arbitrary files from the application's working directory to unauthenticated remote attackers. When `Files::new()` receives a non-existent `serve_from` directory, the library silently substitutes an empty base path; subsequent requests join attacker-supplied filenames against this empty root, which Rust's `canonicalize()` resolves relative to the process working directory, enabling direct file disclosure. A publicly available proof-of-concept exploit exists; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Remote process termination in actix-files 0.6.9 and earlier allows any unauthenticated network attacker to crash a Rust web server by sending a single GET request with an empty Range header, triggering a panic in the static file handler at named.rs:534. The vulnerability is only catastrophic when the application is compiled with `panic = "abort"` - the non-default Rust build profile - because in that mode the entire process terminates rather than unwinding the panicking thread. A publicly available proof-of-concept exists in the vendor advisory, and no public exploit identification beyond a netcat one-liner is required.
An issue was discovered in the actix-http crate before 3.0.0-beta.9 for Rust. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the actix-codec crate before 0.3.0-beta.1 for Rust. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the actix-http crate before 2.0.0-alpha.1 for Rust. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the actix-service crate before 1.0.6 for Rust. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the actix-utils crate before 2.0.0 for Rust. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
HTTP request smuggling in actix-http (versions up to and including 3.12.0) allows unauthenticated remote attackers to desynchronize backend request parsing when the service operates behind an HTTP/1.1 intermediary. The parser accepted requests carrying both Content-Length and Transfer-Encoding: chunked headers (the CL.TE variant) and silently selected chunked decoding instead of rejecting the ambiguous framing as required by RFC 7230, enabling an attacker to prepend malicious content to subsequent backend requests. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Path traversal in the actix-files Rust crate (versions 0.6.9 and earlier) exposes arbitrary files from the application's working directory to unauthenticated remote attackers. When `Files::new()` receives a non-existent `serve_from` directory, the library silently substitutes an empty base path; subsequent requests join attacker-supplied filenames against this empty root, which Rust's `canonicalize()` resolves relative to the process working directory, enabling direct file disclosure. A publicly available proof-of-concept exploit exists; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Remote process termination in actix-files 0.6.9 and earlier allows any unauthenticated network attacker to crash a Rust web server by sending a single GET request with an empty Range header, triggering a panic in the static file handler at named.rs:534. The vulnerability is only catastrophic when the application is compiled with `panic = "abort"` - the non-default Rust build profile - because in that mode the entire process terminates rather than unwinding the panicking thread. A publicly available proof-of-concept exists in the vendor advisory, and no public exploit identification beyond a netcat one-liner is required.
An issue was discovered in the actix-http crate before 3.0.0-beta.9 for Rust. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the actix-codec crate before 0.3.0-beta.1 for Rust. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the actix-http crate before 2.0.0-alpha.1 for Rust. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the actix-service crate before 1.0.6 for Rust. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the actix-utils crate before 2.0.0 for Rust. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.