CVE-2026-72813
Received Received - Intake

actix-files Static File DoS via Empty Range Header

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulnCheck

Description
actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-72813
EUVD
EUVD-2026-58628

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
actix actix-web From 0 (inc) to 0.6.10 (exc)
actix actix-files to 0.6.10 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-248 An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Denial of Service (DoS) vulnerability in actix-files versions before 0.6.10. It occurs when a GET request for static files includes an empty Range header. If the application is compiled with panic set to abort, the server process crashes, causing a denial of service. The issue stems from an uncaught exception during header parsing.

Detection Guidance

To detect this vulnerability, monitor for GET requests with empty Range headers targeting static files served by actix-files. Check server logs for unusual crashes when panic is set to abort. Use tools like Wireshark or tcpdump to capture and inspect HTTP headers for empty Range fields.

Impact Analysis

If you use actix-files versions below 0.6.10 with panic set to abort, attackers can crash your server by sending a single malicious GET request with an empty Range header. This disrupts service availability. Systems using the default panic setting are minimally affected as the connection closes but the server remains operational.

Mitigation Strategies

Upgrade actix-files to version 0.6.10 or later. If upgrading is not possible, disable panic=abort or configure the server to handle empty Range headers safely. Apply network-level protections to block malformed Range headers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72813. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart