Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 6 November 2026.

Which products and versions are affected?

Actix-Http before 3.20.2; actix-http (crates.io) SEMVER:introduced=0.0.0-0,fixed=3.20.2.

Is there a fix for This vulnerability?

Yes. actix-http (crates.io): upgrade to 3.20.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run Actix-Http or actix-http (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

actix-http request smuggling through malformed chunked trailers

Severity: info · Published 2026-11-06

actix-http is a Rust library used to build HTTP services. A flaw in how it parses malformed chunked HTTP requests allows an attacker to smuggle requests past upstream proxies and firewalls, potentially bypassing authentication and access control checks. When a proxy reuses connections, an attacker can craft a specially malformed request to cause the next legitimate request to be misparsed, leading to unauthorized access to protected resources.

Technologies: Actix-Http, actix-http (crates.io). Vendors: Actix, crates.io.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 6 November 2026.
Which products and versions are affected?: Actix-Http before 3.20.2; actix-http (crates.io) SEMVER:introduced=0.0.0-0,fixed=3.20.2.
Is there a fix for This vulnerability?: Yes. actix-http (crates.io): upgrade to 3.20.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run Actix-Http or actix-http (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

actix-http (crates.io): upgrade to 3.20.2 or later
```
cargo update -p actix-http
```

Technical details

The HTTP/1 chunked transfer encoding decoder incorrectly accepts a bare line feed (LF) after the final chunk as the start of trailer headers instead of rejecting the malformed request. When an upstream proxy reuses connections without properly validating the chunked stream, the decoder consumes the next request's headers as trailer data and parses the next request's body as a separate request. This enables request smuggling attacks to bypass proxy-enforced access controls.

Affected products

Actix actix-http before 3.20.2

Identifiers

GHSA-2q7f-mf9f-5qhr
RUSTSEC-2026-0446

Timeline

2026-11-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.