CVE-2026-73051 — actix-http before 3.12.1 HTTP Request Smuggling via CL.TE
actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: ch…
Published: 2026-08-14 · CVSS: 6.3 · CVSS 4.0
actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through a front-end intermediary to desynchronize backend requests and smuggle malicious HTTP requests to the Actix service.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7