actix actix-http vulnerabilities, newest first

By year: all 2026 2025 2024 2023 2022 2021

1. 8.7CVE-2026-128242EPSS 1.0%2026-11-13

   actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed …

2. 6.3CVE-2026-73051EPSS 0.6%2026-08-14

   actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit th…

3. 7.5CVE-2021-38512EPSS 1.8%2021-08-10

   An issue was discovered in the actix-http crate before 3.0.0-beta.9 for Rust. HTTP/1 request smuggling (aka HRS) can occur, potentially leading to credential disclosure.

4. 7.5CVE-2020-35901EPSS 1.4%2020-12-31

   An issue was discovered in the actix-http crate before 2.0.0-alpha.1 for Rust. There is a use-after-free in BodyStream.