Actix
Products
6- 6 CVEs
- 2 CVEs
- 2 CVEs
- 1 CVE
- 1 CVE
- 1 CVE
Recent CVEs
11| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-25025 | Cri | 0.64 | 9.8 | 0.01 | Dec 27, 2021 | An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly extend the lifetime of a string, leading to memory corruption. | ||
| CVE-2018-25026 | Cri | 0.57 | 9.8 | 0.01 | Dec 27, 2021 | An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can add the Send marker trait to an object that cannot be sent between threads safely, leading to memory corruption. | ||
| CVE-2018-25024 | Cri | 0.57 | 9.8 | 0.01 | Dec 27, 2021 | An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly coerce an immutable reference into a mutable reference, leading to memory corruption. | ||
| CVE-2020-35902 | Cri | 0.57 | 9.8 | 0.02 | Dec 31, 2020 | An issue was discovered in the actix-codec crate before 0.3.0-beta.1 for Rust. There is a use-after-free in Framed. | ||
| CVE-2020-35898 | Cri | 0.52 | 9.1 | 0.01 | Dec 31, 2020 | An issue was discovered in the actix-utils crate before 2.0.0 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same data. | ||
| CVE-2020-35901 | Hig | 0.49 | 7.5 | 0.01 | Dec 31, 2020 | An issue was discovered in the actix-http crate before 2.0.0-alpha.1 for Rust. There is a use-after-free in BodyStream. | ||
| CVE-2021-38512 | Hig | 0.42 | 7.5 | 0.02 | Aug 10, 2021 | An issue was discovered in the actix-http crate before 3.0.0-beta.9 for Rust. HTTP/1 request smuggling (aka HRS) can occur, potentially leading to credential disclosure. | ||
| CVE-2026-73051 | Med | 0.41 | — | 0.00 | Aug 14, 2026 | actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through a front-end intermediary to… | ||
| CVE-2026-72813 | Med | 0.38 | — | 0.00 | Aug 14, 2026 | actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header. | ||
| CVE-2026-72814 | Med | 0.34 | — | 0.00 | Aug 14, 2026 | The actix-files crate (actix_files) before version 0.6.10 contains an information exposure vulnerability. When a non-existing folder is passed as the serve_from argument to Files::new(), the mount path defaults to an empty path; the service then joins the request path with this… | ||
| CVE-2020-35899 | Med | 0.29 | 5.5 | 0.00 | Dec 31, 2020 | An issue was discovered in the actix-service crate before 1.0.6 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same data. |
- risk 0.64cvss 9.8epss 0.01
An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly extend the lifetime of a string, leading to memory corruption.
- risk 0.57cvss 9.8epss 0.01
An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can add the Send marker trait to an object that cannot be sent between threads safely, leading to memory corruption.
- risk 0.57cvss 9.8epss 0.01
An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly coerce an immutable reference into a mutable reference, leading to memory corruption.
- risk 0.57cvss 9.8epss 0.02
An issue was discovered in the actix-codec crate before 0.3.0-beta.1 for Rust. There is a use-after-free in Framed.
- risk 0.52cvss 9.1epss 0.01
An issue was discovered in the actix-utils crate before 2.0.0 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same data.
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in the actix-http crate before 2.0.0-alpha.1 for Rust. There is a use-after-free in BodyStream.
- risk 0.42cvss 7.5epss 0.02
An issue was discovered in the actix-http crate before 3.0.0-beta.9 for Rust. HTTP/1 request smuggling (aka HRS) can occur, potentially leading to credential disclosure.
- risk 0.41cvss —epss 0.00
actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through a front-end intermediary to…
- risk 0.38cvss —epss 0.00
actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header.
- risk 0.34cvss —epss 0.00
The actix-files crate (actix_files) before version 0.6.10 contains an information exposure vulnerability. When a non-existing folder is passed as the serve_from argument to Files::new(), the mount path defaults to an empty path; the service then joins the request path with this…
- risk 0.29cvss 5.5epss 0.00
An issue was discovered in the actix-service crate before 1.0.6 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same data.