cve.bz

actix actix-web vulnerabilities, newest first

Filter

By year: all 2026 2025 2024 2023 2022 2021

  1. 8.7CVE-2026-128242EPSS 1.0%

    actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed …

  2. 9.8CVE-2018-25026EPSS 1.4%

    An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can add the Send marker trait to an object that cannot be sent between threads safely, leading to memory corruption.

  3. 9.8CVE-2018-25025EPSS 1.3%

    An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly extend the lifetime of a string, leading to memory corruption.

  4. 9.8CVE-2018-25024EPSS 1.3%

    An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly coerce an immutable reference into a mutable reference, leading to memory corruption.