What is GHSA-rh8q-rpf9-79v6?

GHSA-rh8q-rpf9-79v6 is a security advisory published by GitHub Security Advisories with Medium severity. actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1...

Which CVE IDs does GHSA-rh8q-rpf9-79v6 cover?

GHSA-rh8q-rpf9-79v6 covers the following CVE IDs: CVE-2026-73051. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-rh8q-rpf9-79v6Medium

actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1...

Vendor

GitHub Security Advisories

Published

August 14, 2026

Last Modified

August 14, 2026

🔗 CVE IDs covered (1)

CVE-2026-73051 →

📋 Description

actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through a front-end intermediary to desynchronize backend requests and smuggle malicious HTTP requests to the Actix service.

🔗 References (4)

https://github.com/actix/actix-web/security/advisories/GHSA-xhj4-vrgc-hr34
https://nvd.nist.gov/vuln/detail/CVE-2026-73051
https://www.vulncheck.com/advisories/actix-http-before-http-request-smuggling-via-cl-te
https://github.com/advisories/GHSA-rh8q-rpf9-79v6