EUVD-2026-58619: HTTP request smuggling in actix-http before 3.12.1
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- actix
- Product
- actix-http
- First seen
Summary
The EUVD entry, scored 6.3 under CVSS v3.1, describes an HTTP request smuggling flaw in actix-http versions before 3.12.1. The entry says the HTTP/1.1 parser accepts requests containing both Content-Length and Transfer-Encoding: chunked headers.
If you use actix
Upgrade actix-http to 3.12.1 or later
Check for reverse proxies that may interpret requests differently
Review logs for ambiguous requests carrying both length headers
Upgrade actix-files to version 0.6.10 or later
Check whether your application passes a possibly missing directory to Files::new()
Review exposed paths on affected servers
What the sources say 3
· Mastodon: “actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers.” Source
· Mastodon: “The actix-files crate (actix_files) before version 0.6.10 contains an information exposure vulnerability.” Source
· Mastodon: “actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files.” Source