GHSA-2q7f-mf9f-5qhr json
Request smuggling through malformed chunked request trailers
published 2026-11-06 2 d ago modified 2026-11-06 2 d ago also RUSTSEC-2026-0446
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
The HTTP/1 chunked decoder accepts a bare line feed after the final chunk as the start of a trailer instead of rejecting the malformed request.
When an upstream proxy reuses a connection and either pipelines the requests or does not take steps to validate the chunked stream, the decoder can consume the next request's headers as trailer data. It can then parse that request's body as a new request. An attacker can use this difference in request parsing to bypass access controls enforced by a proxy or web application firewall.
Upgrade to actix-http 3.20.2 or later.
Patch / fix
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | actix-http | >=0.0.0-0, <3.20.2 |
3.20.2 |
References
Sources
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.