GHSA-2q7f-mf9f-5qhr
Request smuggling through malformed chunked request trailers
The HTTP/1 chunked decoder accepts a bare line feed after the final chunk as the start of a trailer instead of rejecting the malformed request.
When an upstream proxy reuses a connection and either pipelines the requests or does not take steps to validate the chunked stream, the decoder can consume the next request's headers as trailer data. It can then parse that request's body as a new request. An attacker can use this difference in request parsing to bypass access controls enforced by a proxy or web application firewall.
Upgrade to actix-http 3.20.2 or later.
What each source reports
OSVRUSTSEC-2026-0446No score
Request smuggling through malformed chunked request trailers
The HTTP/1 chunked decoder accepts a bare line feed after the final chunk as the start of a trailer instead of rejecting the malformed request.
When an upstream proxy reuses a connection and either pipelines the requests or does not take steps to validate the chunked stream, the decoder can consume the next request's headers as trailer data. It can then parse that request's body as a new request. An attacker can use this difference in request parsing to bypass access controls enforced by a proxy or web application firewall.
Upgrade to actix-http 3.20.2 or later.
- Record
RUSTSEC-2026-0446- Updated
- 2026-11-06
Affected packages
| Package | Affected | Fixed |
|---|---|---|
actix-httpcrates.io | 0.0.0-0 up to 3.20.2 | 3.20.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-2q7f-mf9f-5qhr is a vulnerability with no CVSS score yet in actix-http, published November 6, 2026. No source lists public exploit code. Fixed in actix-http 3.20.2.