Vulnerability in Actix Actix-Web
CVE-2026-73051
actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through a front-end intermediary to desynchronize backend requests and smuggle malicious HTTP requests to the Actix service.
Vulnerability class: HTTP Request Smuggling
Published · last modified .
EPSS exploit prediction
EPSS: 0.006 (44.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 45th percentile — 44.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.006 · change: +0.002
Affected products
- Actix Actix-Web — versions 0, 3.12.0
Weakness classification (CWE)
References
- github.com/actix/actix-web/security/advisories/GHSA-xhj4-vrgc-hr34 (vendor-advisory)
- www.vulncheck.com/advisories/actix-http-before-http-request-smuggling-via-cl-te (third-party-advisory)