GHSA-vhj5-x93p-67jw
Medium · 5.4CVSS
5.4
EPSS
—
Published
Mar 11, 2026
CISA due date
—
The record
actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | actix-web-lab | 0 | 0.26.0 |
| Chainguard | parseable | 0 | 2.6.0-r0 |
| Wolfi | parseable | 0 | 2.6.0-r0 |
Related vulnerabilities
- CVE-2026-32829 lz4_flex is a pure Rust implementation of LZ4 compression/decompression. Also affects parseable
- CVE-2026-31812 Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Also affects parseable
- CVE-2026-25727 time provides date and time handling in Rust. Also affects parseable
- CVE-2026-25541 Bytes is a utility library for working with bytes. Also affects parseable
- CVE-2024-12224 `idna` accepts Punycode labels that do not produce any non-ASCII when decoded Also affects parseable
- CVE-2024-47609 Tonic is a native gRPC client & server implementation with async/await support. Also affects parseable
- CVE-2026-87945 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO… CWE-601
- CVE-2026-87937 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central… CWE-601