Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

actix-web-lab

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.4crates.ioPublished

    actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

    GHSA-vhj5-x93p-67jw

    Affected
    • crates.io actix-web-lab <= 0.25.0
    Fixed in
    0.26.0· Vendor fix available
    Issue
    actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior. CVE Assigned CVE ID: CVE-2025-63762 Details The issue is in redirect middleware paths that construct absolute URLs from req.connectioninfo(): 1. actix-web-lab/src/redirecttohttps.rs (around lines 119-132) - let host = conninfo.host(); - format!("https://{hostname}{path}") - format!("https://{hostname}:{port}{path}") 2. actix-web-lab/src/redirecttowww.rs (around lines 30-35) - format!("{scheme}://www.{host}{path}") 3. actix-web-lab/src/redirecttononwww.rs (around lines 30-34) - format!("{scheme}://{hostnowww}{path}") Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host…

    Recommended action: Upgrade to 0.26.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →