Description
actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through a front-end intermediary to desynchronize backend requests and smuggle malicious HTTP requests to the Actix service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| actix | actix-http | < 3.12.1 | 3.12.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rust-actix-http | 3.13.1-1 | — |
| Debian 13 | rust-actix-http | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | rust-actix-http | No fix yet | — |
| Ubuntu 26.04 LTS | rust-actix-http | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | actix-http | < 3.12.1 | 3.12.1 | GHSA-xhj4-vrgc-hr34 |
References
- GitHub Security Advisory (GHSA-xhj4-vrgc-hr34) vendor-advisory
- VulnCheck Advisory: actix-http before 3.12.1 HTTP Request Smuggling via CL.TE third-party-advisory