{"action":"Upgrade actix-files to 0.6.10 or later.","affected":[{"fixed":"0.6.10","introduced":"0"}],"component":"actix-files","cve_ids":["CVE-2026-72813"],"ecosystem":"crates.io","epss":0.00565,"exploited":false,"fixed_versions":["0.6.10"],"ghsa_id":"GHSA-gcqf-3g44-vc9p","id":"tcs_01M5KEZXG4JE7HQV2HY41K1J5C","modified_at":"2026-09-10T03:50:34.968314238Z","published_at":"2026-02-06T19:00:12Z","references":["https://osv.dev/vulnerability/GHSA-gcqf-3g44-vc9p","https://github.com/actix/actix-web/security/advisories/GHSA-gcqf-3g44-vc9p","https://github.com/actix/actix-web","https://github.com/actix/actix-web/blob/0383f4bdd1210e726143ca1ebcf01169b67a4b6c/actix-files/src/named.rs#L530-L535"],"severity":{"label":"medium","score":6.9},"sources":[{"source":"osv","source_id":"GHSA-gcqf-3g44-vc9p","url":"https://osv.dev/vulnerability/GHSA-gcqf-3g44-vc9p"},{"source":"nvd","source_id":"CVE-2026-72813","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72813"}],"summary":"[actix-files] Panic triggered by empty Range header in GET request for static file"}