CVE-2026-73051
Received Received - Intake

HTTP Request Smuggling in Actix-http

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulnCheck

Description
actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through a front-end intermediary to desynchronize backend requests and smuggle malicious HTTP requests to the Actix service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-73051
EUVD
EUVD-2026-58619

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
actix actix-web From 0 (inc) to 3.12.0 (inc)
actix actix-http to 3.12.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-444 The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73051 is an HTTP request smuggling vulnerability in actix-http versions before 3.12.1. It occurs when the parser accepts HTTP/1.1 requests with both Content-Length and Transfer-Encoding: chunked headers. Instead of rejecting conflicting headers, it prioritizes chunked decoding, allowing unauthenticated attackers to exploit mismatched framing between front-end intermediaries and the Actix backend.

Detection Guidance

To detect this vulnerability, inspect HTTP/1.1 requests containing both Content-Length and Transfer-Encoding: chunked headers. Use tools like Wireshark or tcpdump to capture and analyze traffic for conflicting headers. Check web server logs for malformed requests with these headers.

Impact Analysis

This vulnerability allows unauthenticated remote attackers to smuggle malicious HTTP requests through front-end intermediaries like load balancers or WAFs. It can desynchronize backend requests, potentially manipulating how the Actix service processes requests without requiring credentials or user interaction.

Mitigation Strategies

Upgrade actix-http to version 3.12.1 or later. Configure front-end intermediaries (load balancers, WAFs) to reject requests with conflicting Content-Length and Transfer-Encoding headers. Monitor for suspicious request patterns indicating exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73051. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart