CVE-2026-73051Medium▾ Sunlitactix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.6%
actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through a front-end intermediary to desynchronize backend requests and smuggle malicious HTTP requests to the Actix service.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
actix-http < 3.12.1Patched in:
actix-http 3.12.1Connected by shared product, vendor, weakness, or advisory.
CVE-2023-41265Critical· 9.6An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier all…
CVE-2026-118264CriticalEcho: Rejected WebSocket upgrades can bypass Echo route-level access controls
CVE-2026-55458LowCaddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through
CVE-2026-115877Medium· 5.4twisted: Twisted: HTTP request smuggling via improper header delimiter handling (CVE-2026-115877)
GHSA-cxf3-9h37-7rr8CriticalEcho: Rejected WebSocket upgrades can bypass Echo route-level access controls
CVE-2026-111750Medium· 6.3AIOHTTP: Pure-Python parser request smuggling