Actix http: Request smuggling through malformed chunked request trailers
Affects actix-httpSource GCVE Database
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in 3.20.2
Data as of 6 Nov 2026, 15:48 UTC
What to do
Upgrade actix-http to 3.20.2.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.ioactix-httppkg:cargo/actix-httpOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade actix-http to version 3.20.2 or later, where this vulnerability is fixed. No other mitigation steps are indicated by the vendor advisory.
Description
A vulnerability in actix-http's HTTP/1 chunked decoder allows request smuggling via malformed chunked request trailers. The decoder incorrectly accepts a bare line feed after the final chunk as the start of a trailer instead of rejecting the request. This flaw can cause the decoder to consume the next request's headers as trailer data, potentially bypassing access controls enforced by proxies or web application firewalls. The issue is fixed in actix-http version 3.20.2.