The vulnerability is an HTTP request smuggling flaw in Actix Web’s HTTP/1.1 parser that accepts requests containing both a Content-Length header and a Transfer-Encoding: chunked header. An unauthenticated attacker can exploit this by positioning a front‑end intermediary and sending crafted requests that cause the backend Actix service to misinterpret the boundary between HTTP messages, allowing smuggled malicious requests to reach the application. The CVE description does not specify the exact follow‑on impact, but the smuggled request arrives at the application with normal authentication state, potentially enabling the backend to process data it would not normally receive.

The flaw affects Actix Web versions prior to 3.12.1, released by the actix:actix-web project. Servers running these versions are vulnerable; the impact is on the entire application layer when the request reaches the Actix service.

The CVSS score of 6.3 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV. The likely attack vector requires an attacker to control or influence a front‑end proxy or intermediary that forwards requests to the Actix service. Once the smuggling is successful, the disguised request arrives at the application with normal authentication state, enabling further exploitation. Because the flaw requires precise manipulation of HTTP headers, it may be more advanced than typical attacks, but the potential to bypass controls or alter request payloads warrants prompt attention.