Threats affecting pkg:cargo/actix/actix-http

CVE-2026-128242 is an unbounded decompression vulnerability in actix-http and actix-web before versions 3.20.1 and 4.18.2 respectively. It allows remote attackers to cause denial of service by sending small, highly compressed request bodies using gzip, deflate, Brotli, or zstd compression. This leads to excessive memory and CPU consumption during decompression in the encoding::Decoder component.

A vulnerability in actix-http with the compress-brotli feature enabled allows crafted Brotli-encoded HTTP request bodies to bypass decompression memory limits. This can cause the internal buffer to grow to about 1 GiB before the output size limit is reached, potentially exhausting process or host memory with concurrent requests. The issue affects applications that read request bodies via Bytes, String, Json, or Form, even if extractor size limits are configured. The vulnerability is fixed in actix-http version 3.20.3.

A vulnerability in actix-http's encoding::Decoder allows unbounded decompression of compressed input streams, which can lead to excessive memory and CPU consumption. This can cause denial of service when processing untrusted gzip, deflate, Brotli, or Zstandard compressed bodies. The issue affects versions prior to 3.20.1. Fixed in actix-http 3.20.1 and actix-web 4.18.2, where limits on decompression are enforced.

A vulnerability in actix-http's HTTP/1 chunked decoder allows request smuggling via malformed chunked request trailers. The decoder incorrectly accepts a bare line feed after the final chunk as the start of a trailer instead of rejecting the request. This flaw can cause the decoder to consume the next request's headers as trailer data, potentially bypassing access controls enforced by proxies or web application firewalls. The issue is fixed in actix-http version 3.20.2.

actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through a front-end intermediary to desynchronize backend requests and smuggle malicious HTTP requests to the Actix service.