This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-72813 →

UBUNTU-CVE-2026-72813

actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic i...

Original description

The description as published by the source.

actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Ubuntu:26.10 rust-actix-files

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

report ubuntu.com
report cve.org
report github.com
report vulncheck.com