CVE-2026-73051CWE-444

CVE-2026-73051

published August 14, 2026

CVSS
6.3
EPSS
1%
Percentile
46.3
In the wild
Unconfirmed
What it is

actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through a front-end intermediary to desynchronize backend requests and smuggle malicious HTTP requests to the Actix service.

The record
Technical detail
CVSS
6.3 · NONE
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00566 · 46.3th percentile
Weakness
CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Published
2026-08-14T16:16Z
References (2)
https://github.com/actix/actix-web/security/advisories/GHSA-xhj4-vrgc-hr34 · [email protected]https://www.vulncheck.com/advisories/actix-http-before-http-request-smuggling-via-cl-te · [email protected]
EPSS history
Timeline
  • 14 AUG 11:35Z
    actix-http before 3.12.1 HTTP Request Smuggling via CL.TE
    cvelistv5