# actix-http request smuggling through malformed chunked trailers

Source: https://junglewise.ai/threats/rustsec-2026-0446-request-smuggling-through-malformed-chunked-request-5ce6bfaf  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-07  
License: CC BY 4.0 with a link back

Severity: info · Published 2026-11-06

actix-http is a Rust library used to build HTTP services. A flaw in how it parses malformed chunked HTTP requests allows an attacker to smuggle requests past upstream proxies and firewalls, potentially bypassing authentication and access control checks. When a proxy reuses connections, an attacker can craft a specially malformed request to cause the next legitimate request to be misparsed, leading to unauthorized access to protected resources.

Technologies: [Actix-Http](https://junglewise.ai/threats/technologies/actix-actix-http), [actix-http (crates.io)](https://junglewise.ai/threats/technologies/actix-http). Vendors: [Actix](https://junglewise.ai/threats/vendors/actix), [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 6 November 2026.

**Which products and versions are affected?** Actix-Http before 3.20.2; actix-http (crates.io) SEMVER:introduced=0.0.0-0,fixed=3.20.2.

**Is there a fix for This vulnerability?** Yes. actix-http (crates.io): upgrade to 3.20.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Actix-Http or actix-http (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- actix-http (crates.io): upgrade to 3.20.2 or later

  ```sh
  cargo update -p actix-http
  ```


## Technical details

The HTTP/1 chunked transfer encoding decoder incorrectly accepts a bare line feed (LF) after the final chunk as the start of trailer headers instead of rejecting the malformed request. When an upstream proxy reuses connections without properly validating the chunked stream, the decoder consumes the next request's headers as trailer data and parses the next request's body as a separate request. This enables request smuggling attacks to bypass proxy-enforced access controls.

## Affected products

- Actix actix-http before 3.20.2

## Identifiers

- GHSA-2q7f-mf9f-5qhr
- RUSTSEC-2026-0446

## Timeline

- 2026-11-06: disclosed

## References

- [https://crates.io/crates/actix-http](https://crates.io/crates/actix-http)
- [https://rustsec.org/advisories/RUSTSEC-2026-0446.html](https://rustsec.org/advisories/RUSTSEC-2026-0446.html)

## Related threats

- [actix-http memory exhaustion via large-window Brotli](https://junglewise.ai/threats/rustsec-2026-0455-large-window-brotli-bodies-bypass-decompression-8b64dc69)
- [actix-web denial of service via compressed request bodies](https://junglewise.ai/threats/rustsec-2026-0447-compressed-request-bodies-can-exhaust-memory-before-b7c4ea38)
- [actix-http unbounded decompression denial of service](https://junglewise.ai/threats/rustsec-2026-0448-unbounded-decompression-can-exhaust-memory-and-cpu-f56d9644)
- [actix-http has HTTP/1.1 CL.TE Request Smuggling](https://junglewise.ai/threats/cve-2026-73051-actix-http-has-http-1-1-cl-te-request-smuggling)
- [RUSTSEC-2021-0081 - Potential request smuggling capabilities due to lack of input validation](https://junglewise.ai/threats/cve-2021-38512-http-request-smuggling-in-actix-http)