CVE-2026-73051: Actix Actix-Web

Medium severity, CVSS 6.3. EPSS: 0.6% chance of exploitation in the next 30 days.

actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through a front-end intermediary to desynchronize backend requests and smuggle malicious HTTP requests to the Actix service.

Affected products

• Actix Actix-Web: before 3.12.0 (fixed in 3.12.0)

Published 2026-08-14. Last modified 2026-09-24.