TI-2021-16112 Aliases CVE-2021-38512 GHSA-8928-2fgm-6x9x

An issue was discovered in the actix-http crate before 3.0.0-beta.9 for Rust.

LOW 36CWE-444Published 2021-08-10 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

An issue was discovered in the actix-http crate before 3.0.0-beta.9 for Rust. HTTP/1 request smuggling (aka HRS) can occur, potentially leading to credential disclosure.

Why it matters now

EPSS 0.0181 78th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed actix-http (crates.io): 2.2.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	actix-http (crates.io)	before 2.2.1	2.2.1	Patch available	GHSA-8928-2fgm-6x9x

— Vendor— Affected all versions Fixed in — No fix listed CNA
actix-http (crates.io) Vendor— Affected before 2.2.1 Fixed in 2.2.1 Patch available GHSA-8928-2fgm-6x9x

CPE configurations NVD · 11

CPE	Versions	Role	Vendor
cpe:2.3:a:actix:actix-http::::::rust::*	before 3.0.0	Vulnerable	actix
cpe:2.3:a:actix:actix-http:3.0.0:-::::rust::*	3.0.0	Vulnerable	actix
cpe:2.3:a:actix:actix-http:3.0.0:beta1::::rust::*	3.0.0 beta1	Vulnerable	actix
cpe:2.3:a:actix:actix-http:3.0.0:beta2::::rust::*	3.0.0 beta2	Vulnerable	actix
cpe:2.3:a:actix:actix-http:3.0.0:beta3::::rust::*	3.0.0 beta3	Vulnerable	actix
cpe:2.3:a:actix:actix-http:3.0.0:beta4::::rust::*	3.0.0 beta4	Vulnerable	actix
cpe:2.3:a:actix:actix-http:3.0.0:beta5::::rust::*	3.0.0 beta5	Vulnerable	actix
cpe:2.3:a:actix:actix-http:3.0.0:beta6::::rust::*	3.0.0 beta6	Vulnerable	actix
cpe:2.3:a:actix:actix-http:3.0.0:beta7::::rust::*	3.0.0 beta7	Vulnerable	actix
cpe:2.3:a:actix:actix-http:3.0.0:beta8::::rust::*	3.0.0 beta8	Vulnerable	actix

cpe:2.3:a:actix:actix-http:*:*:*:*:*:rust:*:* Versions before 3.0.0 Vulnerable ·actix
cpe:2.3:a:actix:actix-http:3.0.0:-:*:*:*:rust:*:* Versions 3.0.0 Vulnerable ·actix
cpe:2.3:a:actix:actix-http:3.0.0:beta1:*:*:*:rust:*:* Versions 3.0.0 beta1 Vulnerable ·actix
cpe:2.3:a:actix:actix-http:3.0.0:beta2:*:*:*:rust:*:* Versions 3.0.0 beta2 Vulnerable ·actix
cpe:2.3:a:actix:actix-http:3.0.0:beta3:*:*:*:rust:*:* Versions 3.0.0 beta3 Vulnerable ·actix
cpe:2.3:a:actix:actix-http:3.0.0:beta4:*:*:*:rust:*:* Versions 3.0.0 beta4 Vulnerable ·actix
cpe:2.3:a:actix:actix-http:3.0.0:beta5:*:*:*:rust:*:* Versions 3.0.0 beta5 Vulnerable ·actix
cpe:2.3:a:actix:actix-http:3.0.0:beta6:*:*:*:rust:*:* Versions 3.0.0 beta6 Vulnerable ·actix
cpe:2.3:a:actix:actix-http:3.0.0:beta7:*:*:*:rust:*:* Versions 3.0.0 beta7 Vulnerable ·actix
cpe:2.3:a:actix:actix-http:3.0.0:beta8:*:*:*:rust:*:* Versions 3.0.0 beta8 Vulnerable ·actix

Show 1 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:o:fedoraproject:fedora:34:::::::*	34	Vulnerable	Fedoraproject

cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject

Remediation

Fix · GHSA-8928-2fgm-6x9x actix-http (crates.io) Fixed in 2.2.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 1 product

Red Hat Advanced Cluster Management for Kubernetes 2

Timeline

2026-10-02 Threatist record created from CVE-2021-38512
2026-10-03 Alias added: GHSA-8928-2fgm-6x9x

References

Exploit 1

https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/actix-http/RUSTSEC-2021-0081.md

Advisory 3

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences