Description

Request smuggling through malformed chunked request trailers The HTTP/1 chunked decoder accepts a bare line feed after the final chunk as the start of a trailer instead of rejecting the malformed request.

When an upstream proxy reuses a connection and either pipelines the requests or does not take steps to validate the chunked stream, the decoder can consume the next request's headers as trailer data. It can then parse that request's body as a new request. An attacker can use this difference in request parsing to bypass access controls enforced by a proxy or web application firewall.

Upgrade to actix-http 3.20.2 or later.

Mitigation

Aliases

References