CVE-2026-72813: actix-files before 0.6.10 Denial of Service via empty Range header

Severity: medium (CVSS 6.9 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-14 · updated 2026-10-29
Weakness: CWE-248

Description

actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header.

Affected products

actix-files: before 0.6.10 — fixed in 0.6.10

How to fix

Upgrade to a fixed version: actix-files 0.6.10. Check the vendor advisory for mitigations.

References

https://github.com/actix/actix-web/security/advisories/GHSA-gcqf-3g44-vc9p
https://www.vulncheck.com/advisories/actix-files-before-denial-of-service-via-empty-range-header
https://github.com/actix/actix-web/security/advisories/GHSA-gcqf-3g44-vc9p

Get alerted when CVE-2026-72813 or the next vulnerability affects your stack