CVE-2026-73051: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-73051 is an HTTP/1.1 CL.TE (Content-Length/Transfer-Encoding) request smuggling vulnerability in the actix-http Rust crate. The HTTP/1.1 parser incorrectly accepts requests containing both Content-Length and Transfer-Encoding: chunked headers rather than rejecting them, enabling unauthenticated remote attackers to desynchronize backend request processing. All versions of actix-http before 3.12.1 are affected; the issue was disclosed on August 14, 2026, and assigned a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, NVD).

The root cause is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling). When an HTTP/1.1 request contains both a syntactically valid Content-Length header and a Transfer-Encoding: chunked header, the affected parser selects chunked decoding instead of rejecting the ambiguous message as required by RFC 9112. In a CL.TE proxy topology — where an upstream intermediary (proxy, WAF, or load balancer) uses Content-Length framing while forwarding the request to an Actix backend over a reused HTTP/1.1 connection — the front-end and back-end disagree on where the first request ends, allowing bytes intended as part of the first request body to be parsed by the Actix backend as the start of a second HTTP request. Exploitation requires the specific precondition of a reused backend connection and a front-end intermediary that forwards ambiguous framing rather than rejecting it (GitHub Advisory, VulnCheck Advisory).

Successful exploitation enables backend request desynchronization, allowing an attacker to inject malicious HTTP requests that bypass security controls (such as WAF rules or authentication checks) enforced by the front-end intermediary and reach the Actix backend service directly. The primary impact is a low integrity effect on requests processed by the vulnerable Actix service; no direct confidentiality or availability impact is scored. There is no evidence of subsequent-system impact, lateral movement capability, or direct data exfiltration in the current advisory scope (GitHub Advisory, Feedly).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is 0.0, and CISA's SSVC assessment classifies exploitation as "none" and the vulnerability as not automatable. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a specific proxy topology and is not trivially automatable, reducing near-term risk (NVD, Feedly).

1. Reconnaissance: Identify target applications built with actix-web or awc that are deployed behind an HTTP/1.1 intermediary (reverse proxy, WAF, or load balancer) that reuses backend connections and forwards ambiguous request framing.
2. Confirm CL.TE topology: Verify that the front-end intermediary uses Content-Length framing when forwarding requests to the Actix backend, while the backend parses Transfer-Encoding: chunked.
3. Craft ambiguous request: Construct an HTTP/1.1 request containing both a Content-Length header (sized to include a smuggled prefix) and a Transfer-Encoding: chunked header, embedding a partial second HTTP request in the body after the declared Content-Length boundary.
4. Send via front-end: Transmit the crafted request through the front-end intermediary over a reused backend connection. The front-end reads up to Content-Length bytes and forwards the remainder; the Actix backend, using chunked decoding, reads to the terminating chunk marker and treats the remaining bytes as a new request.
5. Achieve desynchronization: The smuggled prefix is prepended to the next legitimate user's request on the shared backend connection, potentially injecting unauthorized headers, bypassing access controls, or poisoning the request pipeline (GitHub Advisory, VulnCheck Advisory).

• Network: HTTP/1.1 requests to the Actix service containing both Content-Length and Transfer-Encoding: chunked headers simultaneously; unexpected or malformed requests appearing in backend access logs that do not correspond to any front-end access log entry.
• Logs: Backend access logs showing requests with unusual or unexpected HTTP methods, paths, or headers that were not initiated by legitimate clients; discrepancies between front-end proxy logs and Actix backend logs for the same connection (e.g., mismatched request counts per connection).
• Application Behavior: Legitimate users receiving responses intended for other users; unexpected authorization bypasses or access to restricted endpoints without corresponding front-end log entries.

The vulnerability is fixed in actix-http version 3.12.1, which rejects HTTP/1.1 requests containing both Content-Length and Transfer-Encoding: chunked headers. Users should upgrade by running cargo update -p actix-http and ensuring dependency resolution selects version 3.12.1 or later; applications using actix-web, awc, or other Actix crates should verify the resolved actix-http version. As an interim workaround if immediate upgrade is not possible, configure all upstream HTTP intermediaries to reject or normalize HTTP/1.1 requests containing both conflicting framing headers before forwarding to the Actix backend (GitHub Advisory).

The vulnerability was disclosed through coordinated disclosure by researcher mufeedvh and published by the actix-web maintainer JohnTitor via GitHub Security Advisories. The CVE was assigned and published by VulnCheck on August 14, 2026. No significant broader media coverage or notable community controversy has been observed beyond standard vulnerability database aggregation (GitHub Advisory, VulnCheck Advisory).