{"id":"RUSTSEC-2026-0446","summary":"Request smuggling through malformed chunked request trailers","details":"The HTTP/1 chunked decoder accepts a bare line feed after the final chunk as\nthe start of a trailer instead of rejecting the malformed request.\n\nWhen an upstream proxy reuses a connection and either pipelines the requests or\ndoes not take steps to validate the chunked stream, the decoder can consume the\nnext request's headers as trailer data. It can then parse that request's body as\na new request. An attacker can use this difference in request parsing to bypass\naccess controls enforced by a proxy or web application firewall.\n\nUpgrade to actix-http 3.20.2 or later.","aliases":["GHSA-2q7f-mf9f-5qhr"],"modified":"2026-11-06T14:45:02.841269143Z","published":"2026-11-06T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/actix-http"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0446.html"},{"type":"WEB","url":"https://github.com/actix/actix-web/commit/feed12e9ec59b39abe90590bf48ae6399ed45b56"}],"affected":[{"package":{"name":"actix-http","ecosystem":"crates.io","purl":"pkg:cargo/actix-http"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"3.20.2"}]}],"ecosystem_specific":{"affects":{"os":[],"functions":[],"arch":[]},"affected_functions":null},"database_specific":{"categories":[],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0446.json"}}],"schema_version":"1.9.2"}