6 results · Feed
-
Unscored —
Large-window Brotli bodies bypass decompression memory limits
With the `compress-brotli` feature enabled, the decoder accepts the non-standard large-window Brotli format. A crafted stream can cause its internal buffer to grow to about 1 GiB before the decoded output reaches the configured size limit. An 850-byte request…
-
Unscored —
Request smuggling through malformed chunked request trailers
The HTTP/1 chunked decoder accepts a bare line feed after the final chunk as the start of a trailer instead of rejecting the malformed request. When an upstream proxy reuses a connection and either pipelines the requests or does not take steps to validate the…
-
Unscored —
Compressed request bodies can exhaust memory before extractor limits apply
Body extractors do not pass their size limits to the decompression layer. A small compressed request can therefore cause a large allocation before the extractor rejects the decoded body. A remote attacker can use this to exhaust memory or CPU resources and ca…
-
Medium 6.3
actix-http before 3.12.1 HTTP Request Smuggling via CL.TE
actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through a front-e…
-
High 7.5
HTTP Request Smuggling in actix-http
An issue was discovered in the actix-http crate before 3.0.0-beta.9 for Rust. HTTP/1 request smuggling (aka HRS) can occur, potentially leading to credential disclosure.
-
High 7.5
Use-after-free in actix-http
An issue was discovered in the actix-http crate before 2.0.0-alpha.1 for Rust. There is a use-after-free in BodyStream.