HTTP Request Smuggling Vulnerability in Actix-HTTP by Actix

CVE-2026-73051

What is CVE-2026-73051?

The actix-http library, specifically in versions earlier than 3.12.1, is susceptible to an HTTP request smuggling vulnerability. This occurs due to the HTTP/1.1 parser's handling of requests that include both the Content-Length header and the Transfer-Encoding: chunked header. Unauthenticated remote attackers can utilize this flaw via a front-end intermediary, leading to desynchronization of backend server requests. This may allow attackers to inject and execute malicious HTTP requests within the Actix service, potentially compromising the integrity and security of affected systems.

References