CVE-2026-73051 PUBLISHED

actix-http before 3.12.1 HTTP Request Smuggling via CL.TE

Assigner: VulnCheck
Reserved: 10.08.2026 Published: 14.08.2026 Updated: 14.08.2026

actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through a front-end intermediary to desynchronize backend requests and smuggle malicious HTTP requests to the Actix service.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS Score: 6.3

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	None	Confidentiality	None
Attack Complexity	Low	Integrity	Low	Integrity	None
Attack Requirements	Present	Availability	None	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	actix
Product	actix-web
Versions	Default: unaffected affected from 0 to 3.12.0 (excl.) Version 3.12.0 is unaffected

Credits

mufeedvh reporter

References

Problem Types

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') CWE