The flaw in actix-files allows an attacker to send a GET request containing an empty Range header. When the process is configured to abort on panic, this header causes the underlying Rust code to panic and terminate the entire web server, resulting in an unavailability of the affected service. The vulnerability does not disclose data or allow privilege escalation; its impact is limited to service disruption.

Any installation of actix-web that includes actix-files versions prior to 0.6.10 is vulnerable. The issue is present in Rust web applications that serve static files through the actix framework and use the default panic handling configuration that aborts on panic.

The CVSS score of 6.9 classifies the risk as medium. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Remote exploitation is straightforward: the attacker only needs to craft a GET request with an empty Range header; no authentication or elevated privileges are required. Because the exploit is simple and can be performed over HTTP, the likelihood of real-world attacks is moderate, especially for services listening on publicly reachable ports.