GitHub Advisoryadvisory · crates.io

GHSA-8928-2fgm-6x9x HTTP Request Smuggling in actix-http

HIGH Published 2021-08-25 Modified 2021-08-18 Official page ↗
Aliases
CVE-2021-38512
Ecosystem
crates.io
Packages
actix-http
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-444
Reviewed
2021-08-18

Affected packages

• crates.io actix-http: < 2.2.1 → fixed in 2.2.1

Description

Affected versions of this crate did not properly detect invalid requests that could allow HTTP/1 request smuggling (HRS) attacks when running alongside a vulnerable front-end proxy server. This can result in leaked internal and/or user data, including credentials, when the front-end proxy is also vulnerable. Popular front-end proxies and load balancers already mitigate HRS attacks so it is recommended that they are also kept up to date; check your specific set up. You should upgrade even if the front-end proxy receives exclusively HTTP/2 traffic and connects to the back-end using HTTP/1; several downgrade attacks are known that can also expose HRS vulnerabilities.

Related

Alias · CVE (1)

  • CVE-2021-38512 An issue was discovered in the actix-http crate before 3.0.0-beta.9 for Rust. vulnerability

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References