The vulnerability in actix-files (prior to 0.6.10) allows remote attackers to cause a denial of service by sending a GET request containing an empty Range header targeting static files. When the actix-web server is configured with panic set to abort, this input triggers an uncaught exception that crashes the process. No privilege or user interaction is required, and the attack vector is network-based. There is no indication of active exploitation in the wild or an official patch or remediation level provided at this time.

Successful exploitation results in a denial of service condition by crashing the actix-web process handling static file requests. This can disrupt availability of the web service. No other impacts such as code execution or data disclosure are described.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider mitigating by disabling or restricting use of Range headers in requests or adjusting panic settings if possible to prevent process abort on panic.