CVE-2026-72813 in actix-files
Summary
by MITRE • 08/14/2026
actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
The vulnerability in actix-files versions prior to 0.6.10 represents a critical denial of service weakness that can be exploited remotely to terminate application processes. This flaw specifically manifests when processing GET requests for static file resources where the Range header is empty or malformed. The issue stems from the library's inadequate handling of edge cases in HTTP request parsing, particularly around range request processing which is commonly used for partial content retrieval.
The technical implementation of this vulnerability occurs within the actix-web framework's file serving component where range headers are processed without proper validation. When an attacker sends a GET request containing an empty Range header, the system fails to gracefully handle this malformed input and instead triggers an abrupt process termination when panic handling is configured to abort rather than recover from errors. This behavior violates fundamental principles of robust error handling in web applications and demonstrates poor defensive programming practices that can be categorized under CWE-400.
The operational impact of this vulnerability extends beyond simple service disruption as it allows remote attackers to execute controlled process crashes at will, effectively enabling a persistent denial of service attack against systems utilizing affected versions of actix-files. Attackers can repeatedly send malicious requests with empty Range headers to cause repeated service interruptions, potentially leading to system unavailability and service degradation that impacts legitimate users. This vulnerability particularly affects web applications built on the rust actix-web framework where static file serving is enabled.
Mitigation strategies should focus on upgrading to actix-files version 0.6.10 or later where proper input validation has been implemented to handle empty Range headers gracefully. Organizations should also implement additional defensive measures such as rate limiting for incoming requests, request filtering to block malformed headers, and comprehensive error handling that prevents process termination from unhandled exceptions. The vulnerability can be mapped to ATT&CK technique T1499.004 which covers network denial of service attacks through resource exhaustion or process termination. Additionally, this weakness aligns with CWE-665 Improper Initialization and CWE-707 Improper Neutralization of Special Elements used in a Command to prevent unauthorized process manipulation. System administrators should also consider implementing intrusion detection systems that can identify and block suspicious Range header patterns, along with regular security audits to ensure proper error handling configurations across all web application components.