Actix is a lightweight, asynchronous Rust web framework and HTTP toolkit whose vulnerability footprint, though narrow in product count, reaches a prominent position because of its wide adoption in web services and microservices. Vulnerabilities affecting the vendor skew strongly toward critical-severity outcomes and concentrate in core HTTP handling libraries such as actix-web, actix-http, and actix-codec, recurring through memory-safety and protocol-interpretation weakness classes including use-after-free, out-of-bounds writes, and HTTP request/response smuggling. Defenders deploying Actix-based services should prioritize updates to these foundational components; live severity and exploitation figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Actix over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-25025CRITICAL An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly extend the lifetime of a string, leading to memory corruption. | Dec 27, 2021 | 9.8 | 31 | NO | NO |
CVE-2018-25026CRITICAL An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can add the Send marker trait to an object that cannot be sent between threads safely, leading to memory c | Dec 27, 2021 | 9.8 | 30 | NO | NO |
CVE-2018-25024CRITICAL An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly coerce an immutable reference into a mutable reference, leading to memory corruption. | Dec 27, 2021 | 9.8 | 30 | NO | NO |
CVE-2020-35902CRITICAL An issue was discovered in the actix-codec crate before 0.3.0-beta.1 for Rust. There is a use-after-free in Framed. | Dec 31, 2020 | 9.8 | 30 | NO | NO |
CVE-2020-35898CRITICAL An issue was discovered in the actix-utils crate before 2.0.0 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same data. | Dec 31, 2020 | 9.1 | 26 | NO | NO |
CVE-2021-38512HIGH An issue was discovered in the actix-http crate before 3.0.0-beta.9 for Rust. HTTP/1 request smuggling (aka HRS) can occur, potentially leading to credential disclosure. | Aug 10, 2021 | 7.5 | 25 | NO | NO |
CVE-2020-35901HIGH An issue was discovered in the actix-http crate before 2.0.0-alpha.1 for Rust. There is a use-after-free in BodyStream. | Dec 31, 2020 | 7.5 | 23 | NO | NO |
CVE-2020-35899MEDIUM An issue was discovered in the actix-service crate before 1.0.6 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same data. | Dec 31, 2020 | 5.5 | 18 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Actix.
Media articles that mention a CVE ID that affects a product developed by Actix — matched by CVE ID, not by vendor name.