CVE-2026-73051: actix-http before 3.12.1 HTTP Request Smuggling via CL.TE

Severity: medium (CVSS 6.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-14 · updated 2026-10-29
Weakness: CWE-444

Description

actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through a front-end intermediary to desynchronize backend requests and smuggle malicious HTTP requests to the Actix service.

Affected products

Actix-Http: before 3.12.1 — fixed in 3.12.1

How to fix

Upgrade to a fixed version: Actix-Http 3.12.1. Check the vendor advisory for mitigations.

References

https://github.com/actix/actix-web/security/advisories/GHSA-xhj4-vrgc-hr34
https://www.vulncheck.com/advisories/actix-http-before-http-request-smuggling-via-cl-te

Get alerted when CVE-2026-73051 or the next vulnerability affects your stack