RUSTSEC-2020-0048: actix-http: Use-after-free in BodyStream due to lack of pinning


Affected versions of this crate did not require the buffer wrapped in BodyStream to be pinned, but treated it as if it had a fixed location in memory. This may result in a use-after-free.

The flaw was corrected by making the trait MessageBody require Unpin and making poll_next() function accept Pin<&mut Self> instead of &mut self.

More Info

Patched Versions