Rust advisories / actix-web
Vulnerability CriticalRUSTSEC-2018-0019 · actix-web
RUSTSEC-2018-0019: Multiple memory safety issues
Short answerA security vulnerability in the actix-web crate: Multiple memory safety issues. GitHub rates it Critical. Fixed in 0.7.20: update to a fixed version.
| Crate | actix-web |
|---|---|
| Type | Vulnerability (memory-corruption) |
| Affected versions | Before 0.7.20. |
| Fixed in | 0.7.20 |
| Severity | Critical (GitHub rating) |
| Published | 2018-06-08 |
| Last changed | 2026-06-01 |
| Also known as | CVE-2018-25024, CVE-2018-25025, CVE-2018-25026, GHSA-7x36-h62w-vw65, GHSA-9qj6-4rfq-vm84, GHSA-fgfm-hqjw-3265, GHSA-w65j-g6c7-g3m4 |
What to do
- See which version you have:
cargo tree -i actix-web(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p actix-web. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for exampleactix-web = "0.7.20") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
Affected versions contain multiple memory safety issues, such as:
- Unsoundly coercing immutable references to mutable references
- Unsoundly extending lifetimes of strings
- Adding the
Sendmarker trait to objects that cannot be safely sent between threads
This may result in a variety of memory corruption scenarios, most likely use-after-free.
A significant refactoring effort has been conducted to resolve these issues.
References
- Package: crates.io/crates/actix-web
- Advisory: rustsec.org/advisories/RUSTSEC-2018-0019.html
- Report: github.com/actix/actix-web/issues/289
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?