diff --git a/Cargo.lock b/Cargo.lock index 640e0844d..08f1e7b1e 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -49,7 +49,7 @@ dependencies = [ [[package]] name = "actix-http" -version = "3.12.0" +version = "3.12.1" dependencies = [ "actix-codec", "actix-http-test", diff --git a/actix-http/CHANGES.md b/actix-http/CHANGES.md index 115774f6a..c0ff503fd 100644 --- a/actix-http/CHANGES.md +++ b/actix-http/CHANGES.md @@ -2,7 +2,11 @@ ## Unreleased -- Reject HTTP/1 requests with ambiguous request framing from `Content-Length` and `Transfer-Encoding` headers to prevent request smuggling. +## 3.12.1 + +**Notice: This release contains a security fix. Users are encouraged to update to this version ASAP.** + +- SECURITY: Reject HTTP/1 requests with ambiguous request framing from `Content-Length` and `Transfer-Encoding` headers to prevent request smuggling. - Encode the HTTP/1 `Connection: Upgrade` header in Camel-Case when camel-case header formatting is enabled.[#3953] - Fix `HeaderMap` iterators' `len()` and `size_hint()` implementations for multi-value headers. - Update `rand` dependency to `0.10`. diff --git a/actix-http/Cargo.toml b/actix-http/Cargo.toml index a617459b8..07a4090c9 100644 --- a/actix-http/Cargo.toml +++ b/actix-http/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "actix-http" -version = "3.12.0" +version = "3.12.1" authors = ["Nikolay Kim ", "Rob Ede "] description = "HTTP types and services for the Actix ecosystem" keywords = ["actix", "http", "framework", "async", "futures"] diff --git a/actix-web/Cargo.toml b/actix-web/Cargo.toml index bb24ab175..e1cae53e3 100644 --- a/actix-web/Cargo.toml +++ b/actix-web/Cargo.toml @@ -137,7 +137,7 @@ actix-service = "2" actix-tls = { version = "3.4", default-features = false, optional = true } actix-utils = "3" -actix-http = "3.12.0" +actix-http = "3.12.1" actix-router = { version = "0.5.4", default-features = false, features = ["http"] } actix-web-codegen = { version = "4.3", optional = true, default-features = false } diff --git a/awc/Cargo.toml b/awc/Cargo.toml index 86b319e42..3fb11b584 100644 --- a/awc/Cargo.toml +++ b/awc/Cargo.toml @@ -98,7 +98,7 @@ dangerous-h2c = [] [dependencies] actix-codec = "0.5" -actix-http = { version = "3.12.0", features = ["http2", "ws"] } +actix-http = { version = "3.12.1", features = ["http2", "ws"] } actix-rt = { version = "2.1", default-features = false } actix-service = "2" actix-tls = { version = "3.4", features = ["connect", "uri"] }