RUSTSEC-2026-0446: Request smuggling through malformed chunked request trailers
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Newbie friendliness
- 53/100
Research direction
The issue reports an advisory for actix-http and says to upgrade to 3.20.2 or later, but it does not name a docs.rs file or specific change to make. Start by checking how docs.rs handles RustSec advisories and determine whether the advisory is already reflected; done means the reported vulnerability and patched version are accurately represented in the relevant docs.rs output.
Written by the indexing model from the issue text.
Description
Request smuggling through malformed chunked request trailers
| Details | |
|---|---|
| Package | actix-http |
| Version | 3.20.0 |
| URL | https://github.com/actix/actix-web/commit/feed12e9ec59b39abe90590bf48ae6399ed45b56 |
| Date | 2026-11-06 |
| Patched versions | >=3.20.2 |
The HTTP/1 chunked decoder accepts a bare line feed after the final chunk as
the start of a trailer instead of rejecting the malformed request.
When an upstream proxy reuses a connection and either pipelines the requests or
does not take steps to validate the chunked stream, the decoder can consume the
next request's headers as trailer data. It can then parse that request's body as
a new request. An attacker can use this difference in request parsing to bypass
access controls enforced by a proxy or web application firewall.
Upgrade to actix-http 3.20.2 or later.
See advisory page for additional details.
- Dominant language
- Rust
- Stars
- 1.2k
- Forks
- 235
- Avg merge
- 11h 56m
- Merged PRs (30d)
- 78
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from rust-lang/docs.rs
-
Add a changelogOpenC-technical-debt E-easy mentor P-medium
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
rust-lang/docs.rs#1013 · 5 comments · 1 reaction ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 30/100
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 52/100
Maintainers usually reply within 1 day
-
Difficulty 3/5 Half a day Newbie friendliness 58/100
rust-lang/docs.rs#3650 · 2 comments ·
Maintainers usually reply within 1 day
All issues in rust-lang/docs.rs
Similar issues
-
good first issue help wanted program
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
hffgzktbcc-blip/ounce-core#297 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
nautechsystems/nautilus_trader#5631 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 69/100
bytecodealliance/rustix#1736 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
longbridge/gpui-kit#3871 ·
Maintainers usually reply within 1 day
-
area:models enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day