CRITICAL9.8

GHSA-7x36-h62w-vw65

Out-of-bounds Write in actix-web

Details

An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can add the Send marker trait to an object that cannot be sent between threads safely, leading to memory corruption.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/actix-web

Introduced in: 0Fixed in: 0.7.19

Upgrade actix-web to 0.7.19 or newer (ecosystem crates.io).

References

https://nvd.nist.gov/vuln/detail/CVE-2018-25026[ADVISORY]
https://github.com/actix/actix-web/issues/289[WEB]
https://github.com/actix/actix-web.git[PACKAGE]
https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/actix-web/RUSTSEC-2018-0019.md[WEB]
https://rustsec.org/advisories/RUSTSEC-2018-0019.html[WEB]