CVE-2021-38512: Actix Actix-HTTP

High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days.

An issue was discovered in the actix-http crate before 3.0.0-beta.9 for Rust. HTTP/1 request smuggling (aka HRS) can occur, potentially leading to credential disclosure.

Affected products

• Actix Actix-HTTP: before 3.0.0 (fixed in 3.0.0); version 3.0.0 only
• Fedoraproject Fedora: version 34 only

Published 2021-08-10. Last modified 2026-06-17.