{"id":"CVE-2026-73051","title":"actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers","summary":"actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit …","severity":"medium","cwe":["CWE-444"],"vendor":"actix-http","product":"actix-http","affected":["actix-http < 3.12.1"],"patched":["actix-http 3.12.1"],"published":"2026-08-14","updated":"2026-09-24","sourceUpdated":"2026-09-24T20:02:50.260","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73051","references":[{"url":"https://github.com/actix/actix-web/security/advisories/GHSA-xhj4-vrgc-hr34","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/actix-http-before-http-request-smuggling-via-cl-te","label":"disclosure@vulncheck.com"},{"url":"https://github.com/actix/actix-web"},{"url":"https://github.com/actix/actix-web/releases/tag/http-v3.12.1"},{"url":"https://www.rfc-editor.org/rfc/rfc9112.html#name-message-body-length"}],"tags":["nvd","osv","rust"],"epss":0.00566,"epssPercentile":0.46786,"aliases":["GHSA-xhj4-vrgc-hr34"],"ecosystem":"rust","ingestedAt":"2026-08-15T19:19:54.531Z","slug":"CVE-2026-73051","body":"## Overview\n\nactix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through a front-end intermediary to desynchronize backend requests and smuggle malicious HTTP requests to the Actix service.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-73051)\n\nAffected packages:\n\n- `actix-http < 3.12.1`\n\nPatched in:\n\n- `actix-http 3.12.1`\n\nSource: https://osv.dev/vulnerability/GHSA-xhj4-vrgc-hr34","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}