CVE-2021-38512 json
HTTP Request Smuggling in actix-http
published 2021-06-16 5 y ago modified 2026-06-17 4 mo ago also GHSA-8928-2fgm-6x9x , RUSTSEC-2021-0081 , EUVD-2021-1635
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.8%
- EPSS 1.8% chance of exploitation in 30 days, percentile 78%
- public exploits
- 0
- none known
Summary
An issue was discovered in the actix-http crate before 3.0.0-beta.9 for Rust. HTTP/1 request smuggling (aka HRS) can occur, potentially leading to credential disclosure.
Patch / fix
- crates.io actix-http 2.2.1, 3.0.0-beta.9
- actix actix-http 3.0.0
- github.com/actix/actix-web@e965d82 commit
- github.com/actix/actix-web#2363 pull request
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2021-38512 updated cvss 7.5
rust-actix-http: potential request smuggling capabilities due to lack of input validation
-
Red Hat Advanced Cluster Management for Kubernetes 2 cincinnati-containernot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
1.81% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- raw.githubusercontent.com https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/actix-http/RUSTSEC-2021-0081.md referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | actix-http | <2.2.1 >=0.0.0-0, <2.2.1 >=3.0.0-0, <3.0.0-beta.9 |
2.2.1 3.0.0-beta.9 |
Classification
- Weakness
-
- CWE-444 Inconsistent Interpretation of HTTP Requests
References
-
github.com
/actix/actix-web/pull/2363
web
-
github.com
/actix/actix-web/commit/e965d8298f421e9c89fe98b1300b8361e948c324
web
-
raw.githubusercontent.com
/rustsec/advisory-db/main/crates/actix-http/RUSTSEC-2021-0081.md
web, exploit, third-party-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/67URRW4K47SR6LNQB4YALPLGGQMQK7HO/
vendor-advisory
-
rustsec.org
/advisories/RUSTSEC-2021-0081.html
web, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-38512
advisory
-
github.com
/actix/actix-web
package
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/67URRW4K47SR6LNQB4YALPLGGQMQK7HO
web
-
crates.io
/crates/actix-http
package
Sources
- CVE List CVE-2021-38512
- GitHub Advisory GHSA-8928-2fgm-6x9x
- NVD CVE-2021-38512
- OSV RUSTSEC-2021-0081
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.