{"id":"EUVD-2026-58619","enisaUuid":"25a2b84d-7b21-3952-a70f-f4ba31bba9a1","description":"actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through a front-end intermediary to desynchronize backend requests and smuggle malicious HTTP requests to the Actix service.","datePublished":"Aug 14, 2026, 11:35:45 AM","dateUpdated":"Oct 29, 2026, 9:16:52 PM","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/actix/actix-web/security/advisories/GHSA-xhj4-vrgc-hr34\nhttps://www.vulncheck.com/advisories/actix-http-before-http-request-smuggling-via-cl-te\n","aliases":"CVE-2026-73051\nGHSA-rh8q-rpf9-79v6\n","assigner":"VulnCheck","epss":0.57,"enisaIdProduct":[{"id":"f32b5ab8-2040-3d6c-952f-e09d3ecb92d5","product":{"name":"actix-http","vendor":{"name":"actix"}},"product_version":"0 \u003c3.12.1"}],"enisaIdVendor":[{"id":"ab92451d-8482-308a-8479-33081c726b97","vendor":{"name":"actix"}}],"enisaIdVulnerability":[{"id":"45bf3f86-e798-3673-811b-a205ffdca378","vulnerability":{"id":"GHSA-rh8q-rpf9-79v6","description":"actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through a front-end intermediary to desynchronize backend requests and smuggle malicious HTTP requests to the Actix service.","datePublished":"Aug 14, 2026, 12:31:28 PM","dateUpdated":"Aug 14, 2026, 12:31:28 PM","baseScore":0.0,"references":"https://github.com/actix/actix-web/security/advisories/GHSA-xhj4-vrgc-hr34\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-73051\nhttps://www.vulncheck.com/advisories/actix-http-before-http-request-smuggling-via-cl-te\n","enisa_id":"EUVD-2026-58619\n","aliases":"GHSA-rh8q-rpf9-79v6\nCVE-2026-73051\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:49 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d8a8cd24-0eb6-3780-83c3-d27eeba643d7","vulnerability":{"id":"CVE-2026-73051","description":"actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through a front-end intermediary to desynchronize backend requests and smuggle malicious HTTP requests to the Actix service.","datePublished":"Aug 14, 2026, 11:35:45 AM","dateUpdated":"Oct 29, 2026, 9:16:52 PM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/actix/actix-web/security/advisories/GHSA-xhj4-vrgc-hr34\nhttps://www.vulncheck.com/advisories/actix-http-before-http-request-smuggling-via-cl-te\n","enisa_id":"EUVD-2026-58619\n","assigner":"VulnCheck","epss":0.57,"dataProcessed":"Nov 3, 2026, 7:14:26 AM","vulnerabilityProduct":[{"id":"bc8f8ed3-95a3-3982-9d15-8dfd493ba005","product":{"name":"actix-http","vendor":{"name":"actix"}},"product_version":"0 \u003c3.12.1"}],"vulnerabilityVendor":[{"id":"9ae4e787-488e-3f41-82e1-7d2335cdc318","vendor":{"name":"actix"}}]}}],"enisaIdAdvisory":[]}