actix-web-lab

Version	Released
`0.29.5` patch	Oct 10, 2026
`0.29.4` patch	Oct 09, 2026
`0.29.3` patch	Oct 09, 2026
`0.29.2` patch	Oct 08, 2026
`0.29.1` patch	Oct 08, 2026
`0.29.0` minor	Oct 01, 2026
`0.28.0` minor	Sep 23, 2026
`0.27.0` minor	Aug 24, 2026
`0.26.0` unknown	Mar 10, 2026
`0.25.0` unknown 1 CVE	Feb 24, 2026
`0.24.3` unknown 1 CVE	Aug 20, 2025
`0.24.2` unknown 1 CVE	Jul 14, 2025
`0.24.1` unknown 1 CVE	Mar 11, 2025
`0.24.0` unknown 1 CVE	Mar 08, 2025
`0.23.0` unknown 1 CVE	Oct 15, 2024
`0.22.0` unknown 1 CVE	Aug 10, 2024
`0.21.0` unknown 1 CVE	Aug 04, 2024
`0.20.2` unknown 1 CVE	Jan 26, 2024
`0.20.1` unknown 1 CVE	Nov 18, 2023
`0.20.0` unknown 1 CVE	Oct 25, 2023
`0.19.2` unknown 1 CVE	Oct 16, 2023
`0.19.1` unknown 1 CVE	Feb 26, 2023
`0.19.0` unknown 1 CVE	Feb 19, 2023
`0.18.9` unknown 1 CVE	Jan 02, 2023
`0.18.8` unknown 1 CVE	Dec 10, 2022
`0.18.7` unknown 1 CVE	Dec 10, 2022
`0.18.6` unknown 1 CVE	Dec 08, 2022
`0.18.5` unknown 1 CVE	Oct 13, 2022
`0.18.4` unknown 1 CVE	Oct 09, 2022
`0.18.3` unknown 1 CVE	Oct 01, 2022
`0.18.2` unknown 1 CVE	Sep 13, 2022
`0.18.1` unknown 1 CVE	Sep 13, 2022
`0.18.0` unknown 1 CVE	Sep 13, 2022
`0.17.0` unknown 1 CVE	Aug 09, 2022
`0.16.9` unknown 1 CVE	Aug 07, 2022
`0.16.8` unknown 1 CVE	Aug 07, 2022
`0.16.7` unknown 1 CVE	Jul 27, 2022
`0.16.6` unknown 1 CVE	Jul 27, 2022
`0.16.5` unknown 1 CVE	Jul 24, 2022
`0.16.4` unknown 1 CVE	Jul 03, 2022
`0.16.3` unknown 1 CVE	Jul 03, 2022
`0.16.2` unknown 1 CVE	Jul 02, 2022
`0.16.1` unknown 1 CVE	Apr 23, 2022
`0.16.0` unknown 1 CVE	Apr 11, 2022
`0.15.2` unknown 1 CVE	Apr 08, 2022
`0.15.1` unknown 1 CVE	Apr 07, 2022
`0.15.0` unknown 1 CVE	Mar 07, 2022
`0.14.0` unknown 1 CVE	Mar 07, 2022
`0.13.0` unknown 1 CVE	Mar 03, 2022
`0.12.1` unknown 1 CVE	Mar 02, 2022

0.29.5 patch

Oct 10, 2026

0.29.4 patch

Oct 09, 2026

0.29.3 patch

Oct 09, 2026

0.29.2 patch

Oct 08, 2026

0.29.1 patch

Oct 08, 2026

0.29.0 minor

Oct 01, 2026

0.28.0 minor

Sep 23, 2026

0.27.0 minor

Aug 24, 2026

0.26.0 unknown

Mar 10, 2026

0.25.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 24, 2026

0.24.3 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 20, 2025

0.24.2 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 14, 2025

0.24.1 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 11, 2025

0.24.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 08, 2025

0.23.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 15, 2024

0.22.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 10, 2024

0.21.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 04, 2024

0.20.2 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 26, 2024

0.20.1 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 18, 2023

0.20.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 25, 2023

0.19.2 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 16, 2023

0.19.1 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 26, 2023

0.19.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 19, 2023

0.18.9 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 02, 2023

0.18.8 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 10, 2022

0.18.7 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 10, 2022

0.18.6 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 08, 2022

0.18.5 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 13, 2022

0.18.4 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 09, 2022

0.18.3 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 01, 2022

0.18.2 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Sep 13, 2022

0.18.1 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Sep 13, 2022

0.18.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Sep 13, 2022

0.17.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 09, 2022

0.16.9 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 07, 2022

0.16.8 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 07, 2022

0.16.7 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 27, 2022

0.16.6 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 27, 2022

0.16.5 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 24, 2022

0.16.4 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 03, 2022

0.16.3 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 03, 2022

0.16.2 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 02, 2022

0.16.1 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 23, 2022

0.16.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 11, 2022

0.15.2 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 08, 2022

0.15.1 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 07, 2022

0.15.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 07, 2022

0.14.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 07, 2022

0.13.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 03, 2022

0.12.1 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 02, 2022

Activity

Reach

Details