Bug 2516003 (CVE-2026-73051) - CVE-2026-73051 actix-http: Actix-http: HTTP Request Smuggling via malformed HTTP/1.1 headers
Summary: CVE-2026-73051 actix-http: Actix-http: HTTP Request Smuggling via malformed H...
Keywords:
Status: NEW
Alias: CVE-2026-73051
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2537325 2537326
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-14 12:02 UTC by OSIDB Bzimport
Modified: 2026-09-21 08:45 UTC (History)
9 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-14 12:02:05 UTC 
actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through a front-end intermediary to desynchronize backend requests and smuggle malicious HTTP requests to the Actix service.
Note You need to log in before you can comment on or make changes to this bug.