CyberRota Analysis
AI-GeneratedActix-http versions prior to 3.12.1 are vulnerable to an HTTP request smuggling flaw due to improper handling of requests with both Content-Length and Transfer-Encoding: chunked headers. This vulnerability allows unauthenticated remote attackers to exploit the system via a front-end intermediary, potentially leading to desynchronization of backend requests and the injection of malicious HTTP requests. Organizations using affected versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through a front-end intermediary to desynchronize backend requests and smuggle malicious HTTP requests to the Actix service.