CVE-2018-25026
Out-of-bounds Write in actix-web
An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can add the Send marker trait to an object that cannot be sent between threads safely, leading to memory corruption.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can add the Send marker trait to an object that cannot be sent between threads safely, leading to memory corruption.
- Record
CVE-2018-25026- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can add the Send marker trait to an object that cannot be sent between threads safely, leading to memory corruption.
- Record
CVE-2018-25026- Updated
- 2026-11-02
EUVDEUVD-2022-0512 No score
An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can add the Send marker trait to an object that cannot be sent between threads safely, leading to memory corruption.
- Record
EUVD-2022-0512- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7x36-h62w-vw65
Out-of-bounds Write in actix-web
An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can add the Send marker trait to an object that cannot be sent between threads safely, leading to memory corruption.
- Record
GHSA-7x36-h62w-vw65- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w65j-g6c7-g3m4 No score
Multiple memory safety issues in actix-web
Affected versions contain multiple memory safety issues, such as:
- Unsoundly coercing immutable references to mutable references
- Unsoundly extending lifetimes of strings
- Adding the
Sendmarker trait to objects that cannot be safely sent between threads
This may result in a variety of memory corruption scenarios, most likely use-after-free.
A signficant refactoring effort has been conducted to resolve these issues.
- Record
GHSA-w65j-g6c7-g3m4- Weakness
- CWE-362
- Updated
- 2026-11-02
OSVGHSA-7x36-h62w-vw65
Out-of-bounds Write in actix-web
An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can add the Send marker trait to an object that cannot be sent between threads safely, leading to memory corruption.
- Record
GHSA-7x36-h62w-vw65- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-9qj6-4rfq-vm84
Out-of-bounds Write in actix-web
An issue was discovered in the actix-web crate before 0.7.19 for Rust. It can unsoundly coerce an immutable reference into a mutable reference, leading to memory corruption.
- Record
GHSA-9qj6-4rfq-vm84- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSVGHSA-fgfm-hqjw-3265
Out-of-bounds Write in actix-web
An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly extend the lifetime of a string, leading to memory corruption.
- Record
GHSA-fgfm-hqjw-3265- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-25026
An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can add the Send marker trait to an object that cannot be sent between threads safely, leading to memory corruption.
- Record
UBUNTU-CVE-2018-25026- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-w65j-g6c7-g3m4 No score
Multiple memory safety issues in actix-web
Affected versions contain multiple memory safety issues, such as:
- Unsoundly coercing immutable references to mutable references
- Unsoundly extending lifetimes of strings
- Adding the
Sendmarker trait to objects that cannot be safely sent between threads
This may result in a variety of memory corruption scenarios, most likely use-after-free.
A signficant refactoring effort has been conducted to resolve these issues.
- Record
GHSA-w65j-g6c7-g3m4- Weakness
- CWE-362
- Updated
- 2026-11-02
OSVRUSTSEC-2018-0019 No score
Multiple memory safety issues
Affected versions contain multiple memory safety issues, such as:
- Unsoundly coercing immutable references to mutable references
- Unsoundly extending lifetimes of strings
- Adding the
Sendmarker trait to objects that cannot be safely sent between threads
This may result in a variety of memory corruption scenarios, most likely use-after-free.
A significant refactoring effort has been conducted to resolve these issues.
- Record
RUSTSEC-2018-0019- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
actix-webcrates.io |
before 0.7.19 | 0.7.19 |
actix-webcrates.io |
0.0.0-0 up to 0.7.20-0 | 0.7.20-0 |
rust-actix-deriveUbuntu:20.04:LTS |
All versions, plus listed versions 0.5.0-10.5.0-2 |
None known |
rust-actix-deriveUbuntu:22.04:LTS |
All versions, plus listed versions 0.5.0-2 |
None known |
rust-actix-deriveUbuntu:24.04:LTS |
All versions, plus listed versions 0.5.0-2 |
None known |
rust-actix-deriveUbuntu:25.10 |
All versions, plus listed versions 0.5.0-2 |
None known |
rust-actix-deriveUbuntu:26.10 |
All versions, plus listed versions 0.5.0-2build10.6.2-1 |
None known |
rust-actix-deriveUbuntu:26.04:LTS |
All versions, plus listed versions 0.5.0-20.5.0-2build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-25026 is a critical vulnerability (CVSS 9.8) in Actix Actix-web, published June 8, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.37%, the 71st percentile. Fixed in actix-web 0.7.19.