RUSTSEC-2021-0081: Potential request smuggling capabilities due to lack of input validation

What to do

1. See which version you have: cargo tree -i actix-http (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p actix-http. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example actix-http = "3.0.0-beta.9") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Affected versions of this crate did not properly detect invalid requests that could allow HTTP/1 request smuggling (HRS) attacks when running alongside a vulnerable front-end proxy server. This can result in leaked internal and/or user data, including credentials, when the front-end proxy is also vulnerable.

Popular front-end proxies and load balancers already mitigate HRS attacks so it is recommended that they are also kept up to date; check your specific set up. You should upgrade even if the front-end proxy receives exclusively HTTP/2 traffic and connects to the back-end using HTTP/1; several downgrade attacks are known that can also expose HRS vulnerabilities.

References

• Package: crates.io/crates/actix-http
• Advisory: rustsec.org/advisories/RUSTSEC-2021-0081.html

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for actix-http

• Vulnerability HighRUSTSEC-2020-0048 · 2020-01-24Use-after-free in BodyStream due to lack of pinning
• VulnerabilityGHSA-xhj4-vrgc-hr34 · 2026-04-22actix-http has HTTP/1.1 CL.TE Request Smuggling

Full security history of actix-http