{"id":"EUVD-2026-58628","enisaUuid":"e2c14c8d-58df-31a6-ae29-a9eae29a34e7","description":"actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header.","datePublished":"Aug 14, 2026, 11:35:26 AM","dateUpdated":"Oct 29, 2026, 9:16:48 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/actix/actix-web/security/advisories/GHSA-gcqf-3g44-vc9p\nhttps://www.vulncheck.com/advisories/actix-files-before-denial-of-service-via-empty-range-header\n","aliases":"CVE-2026-72813\nGHSA-v47c-94r2-rjm7\n","assigner":"VulnCheck","epss":0.49,"enisaIdProduct":[{"id":"bef52f16-c3f9-3dbb-9d8a-4a26fa88f55b","product":{"name":"actix-files","vendor":{"name":"actix"}},"product_version":"0 \u003c0.6.10"}],"enisaIdVendor":[{"id":"fdf729e7-cb73-3e5f-ba2a-6c232dfc1cf8","vendor":{"name":"actix"}}],"enisaIdVulnerability":[{"id":"401f02f5-7e95-3536-b7d4-60a965ec0077","vulnerability":{"id":"GHSA-v47c-94r2-rjm7","description":"actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header.","datePublished":"Aug 14, 2026, 12:31:24 PM","dateUpdated":"Aug 14, 2026, 12:31:25 PM","baseScore":0.0,"references":"https://github.com/actix/actix-web/security/advisories/GHSA-gcqf-3g44-vc9p\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72813\nhttps://www.vulncheck.com/advisories/actix-files-before-denial-of-service-via-empty-range-header\n","enisa_id":"EUVD-2026-58628\n","aliases":"CVE-2026-72813\nGHSA-v47c-94r2-rjm7\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:49 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"85cce14b-31b9-309e-9869-737a3a0aa728","vulnerability":{"id":"CVE-2026-72813","description":"actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header.","datePublished":"Aug 14, 2026, 11:35:26 AM","dateUpdated":"Oct 29, 2026, 9:16:48 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/actix/actix-web/security/advisories/GHSA-gcqf-3g44-vc9p\nhttps://www.vulncheck.com/advisories/actix-files-before-denial-of-service-via-empty-range-header\n","enisa_id":"EUVD-2026-58628\n","assigner":"VulnCheck","epss":0.49,"dataProcessed":"Nov 3, 2026, 7:13:31 AM","vulnerabilityProduct":[{"id":"e84f8ef6-60ad-3896-bc95-1080a1f9227b","product":{"name":"actix-files","vendor":{"name":"actix"}},"product_version":"0 \u003c0.6.10"}],"vulnerabilityVendor":[{"id":"5416580f-bd13-36dc-a51b-81bbe0e9df6a","vendor":{"name":"actix"}}]}}],"enisaIdAdvisory":[{"id":"cd8babda-6f2e-3c99-a8d1-d5cfaf12fff7","advisory":{"id":"SUSE-SU-2026:23572-1","description":"Security update for gstreamer-devtools","summary":"Security update for gstreamer-devtools","datePublished":"Aug 30, 2026, 2:39:08 PM","dateUpdated":"Sep 29, 2026, 5:27:58 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_23572-1.json\nhttps://www.suse.com/support/update/announcement/2026/suse-su-202623572-1/\nhttps://lists.suse.com/pipermail/sle-security-updates/2026-September/029107.html\nhttps://bugzilla.suse.com/1243178\nhttps://bugzilla.suse.com/1249015\nhttps://bugzilla.suse.com/1257914\nhttps://bugzilla.suse.com/1274306\nhttps://bugzilla.suse.com/1275209\nhttps://bugzilla.suse.com/1275210\nhttps://www.suse.com/security/cve/CVE-2025-4574/\nhttps://www.suse.com/security/cve/CVE-2025-58160/\nhttps://www.suse.com/security/cve/CVE-2026-25541/\nhttps://www.suse.com/security/cve/CVE-2026-25727/\nhttps://www.suse.com/security/cve/CVE-2026-72813/\nhttps://www.suse.com/security/cve/CVE-2026-72814/\n","aliases":"CVE-2025-4574\nCVE-2025-58160\nCVE-2026-25541\nCVE-2026-25727\nCVE-2026-72813\nCVE-2026-72814\n","source":{"id":22,"name":"csaf_suse"},"advisoryProduct":[{"id":"05bd04ca-10b2-3f00-b629-4a9fcaa801ab","product":{"name":"gstreamer-devtools-0:1.26.7-160000.2.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"11d2a801-53f4-30d3-8d6f-fe2c582a90e3","product":{"name":"typelib-1_0-GstValidate-1_0-0:1.26.7-160000.2.1.s390x","vendor":{"name":"SUSE"}}},{"id":"151aaac7-d7ce-3808-8118-7e63f7d3beb1","product":{"name":"SUSE Linux Enterprise Server 16.0","vendor":{"name":"SUSE"}}},{"id":"2a5f2ebe-f6c6-3d6b-a1ba-3af67aaf1b60","product":{"name":"libgstvalidate-1_0-0-0:1.26.7-160000.2.1.s390x","vendor":{"name":"SUSE"}}},{"id":"41b77742-f79b-3682-9658-3257582fdab5","product":{"name":"gstreamer-devtools-0:1.26.7-160000.2.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"505c2c5b-66cc-3fd4-b708-a9af98aea883","product":{"name":"gstreamer-devtools-0:1.26.7-160000.2.1.s390x","vendor":{"name":"SUSE"}}},{"id":"58a73a32-ae59-35e5-95c2-ae6dd05dfb02","product":{"name":"libgstvalidate-1_0-0-0:1.26.7-160000.2.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"74047e4b-6458-3da8-ae68-3bf7e54b8ff5","product":{"name":"gstreamer-devtools-0:1.26.7-160000.2.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"74a66a01-0097-3b86-9671-6501f9ac2d28","product":{"name":"typelib-1_0-GstValidate-1_0-0:1.26.7-160000.2.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"74da4455-6bb0-3ce8-b59b-6fa316e22607","product":{"name":"SUSE Linux Enterprise Server for SAP applications 16.0","vendor":{"name":"SUSE"}}},{"id":"c2dcc7ff-5e1f-34be-8d25-8cbc5f387c62","product":{"name":"libgstvalidate-1_0-0-0:1.26.7-160000.2.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"c6afa195-0b87-3068-8684-86fffb918ea3","product":{"name":"typelib-1_0-GstValidate-1_0-0:1.26.7-160000.2.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"d4a9052b-9e0c-36f4-9d00-c4e49a72648c","product":{"name":"typelib-1_0-GstValidate-1_0-0:1.26.7-160000.2.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"dadbb827-131b-3850-98b7-63fd42f3139b","product":{"name":"libgstvalidate-1_0-0-0:1.26.7-160000.2.1.aarch64","vendor":{"name":"SUSE"}}}]}},{"id":"ffb07b9a-7255-38aa-860c-749629ed8dea","advisory":{"id":"openSUSE-SU-2026:21689-1","description":"Security update for gstreamer-devtools","summary":"Security update for gstreamer-devtools","datePublished":"Aug 30, 2026, 2:39:29 PM","dateUpdated":"Sep 17, 2026, 5:42:51 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21689-1.json\nhttps://bugzilla.suse.com/1243178\nhttps://bugzilla.suse.com/1249015\nhttps://bugzilla.suse.com/1257914\nhttps://bugzilla.suse.com/1274306\nhttps://bugzilla.suse.com/1275209\nhttps://bugzilla.suse.com/1275210\nhttps://www.suse.com/security/cve/CVE-2025-4574/\nhttps://www.suse.com/security/cve/CVE-2025-58160/\nhttps://www.suse.com/security/cve/CVE-2026-25541/\nhttps://www.suse.com/security/cve/CVE-2026-25727/\nhttps://www.suse.com/security/cve/CVE-2026-72813/\nhttps://www.suse.com/security/cve/CVE-2026-72814/\n","aliases":"CVE-2025-4574\nCVE-2025-58160\nCVE-2026-25541\nCVE-2026-25727\nCVE-2026-72813\nCVE-2026-72814\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"04fc15d8-cdb4-3b60-868c-9799b0c64d3d","product":{"name":"libgstvalidate-1_0-0-0:1.26.7-160000.2.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"112777be-871e-3538-9c02-657b6b1aff4d","product":{"name":"typelib-1_0-GstValidate-1_0-0:1.26.7-160000.2.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"15e9d130-9356-30cb-86c2-94dcc0619777","product":{"name":"gstreamer-devtools-devel-0:1.26.7-160000.2.1.s390x","vendor":{"name":"SUSE"}}},{"id":"1850f016-77f7-36c1-a27c-78872ecb3eb1","product":{"name":"libgstvalidate-1_0-0-0:1.26.7-160000.2.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"1cd2ffee-23b5-3d83-95ad-1e51eb5d7eb6","product":{"name":"typelib-1_0-GstValidate-1_0-0:1.26.7-160000.2.1.s390x","vendor":{"name":"SUSE"}}},{"id":"2c43b923-639e-3df6-8217-1b3ef0113606","product":{"name":"openSUSE Leap 16.0","vendor":{"name":"SUSE"}}},{"id":"39b88f40-6ce4-3c2d-b1da-e4554b41c2b2","product":{"name":"libgstvalidate-1_0-0-0:1.26.7-160000.2.1.s390x","vendor":{"name":"SUSE"}}},{"id":"41d3c9d4-fa48-3014-bef2-0277a6418250","product":{"name":"typelib-1_0-GstValidate-1_0-0:1.26.7-160000.2.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"4296e0b7-d836-3b2c-992a-a8f7432bc6cf","product":{"name":"typelib-1_0-GstValidate-1_0-0:1.26.7-160000.2.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"59282319-a125-3618-846d-25a47c9dffd5","product":{"name":"gstreamer-devtools-devel-0:1.26.7-160000.2.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"6087c636-4029-31b3-98e3-7b2dda82b195","product":{"name":"gstreamer-devtools-0:1.26.7-160000.2.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"66c78115-18a9-3236-9c7a-bd989052357e","product":{"name":"gstreamer-devtools-devel-0:1.26.7-160000.2.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"746221cd-8f84-384e-8291-498d3fdb0fbb","product":{"name":"gstreamer-devtools-0:1.26.7-160000.2.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"b45a9c91-e7b4-334d-b9a0-e549137ec134","product":{"name":"libgstvalidate-1_0-0-0:1.26.7-160000.2.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"b541ad56-c61f-32c9-a1aa-601081b65986","product":{"name":"gstreamer-devtools-0:1.26.7-160000.2.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"c0495f57-88b8-3c4c-90c5-ae05d629a20e","product":{"name":"gstreamer-devtools-devel-0:1.26.7-160000.2.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"f6158738-77f1-31f1-8d3c-fdc1f3075371","product":{"name":"gstreamer-devtools-0:1.26.7-160000.2.1.s390x","vendor":{"name":"SUSE"}}}]}}]}