- Reported
-
- Issued
-
- Package
-
actix-http
(crates.io)
- Type
-
Vulnerability
- Aliases
-
- References
-
- Patched
-
Description
The HTTP/1 chunked decoder accepts a bare line feed after the final chunk as
the start of a trailer instead of rejecting the malformed request.
When an upstream proxy reuses a connection and either pipelines the requests or
does not take steps to validate the chunked stream, the decoder can consume the
next request's headers as trailer data. It can then parse that request's body as
a new request. An attacker can use this difference in request parsing to bypass
access controls enforced by a proxy or web application firewall.
Upgrade to actix-http 3.20.2 or later.
Advisory available under CC0-1.0
license.