This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate actix-http

Dependencies

(32 total, 1 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 actix-codec^0.50.5.0up to date
 actix-rt^2.22.8.0up to date
 actix-service^22.0.2up to date
 actix-tls^33.0.3up to date
 actix-utils^33.0.1up to date
 ahash^0.70.8.3out of date
 base64^0.210.21.0up to date
 bitflags^1.21.3.2up to date
 brotli^3.3.33.3.4up to date
 bytes^11.3.0up to date
 bytestring^11.2.0up to date
 derive_more^0.99.50.99.17up to date
 encoding_rs^0.80.8.31up to date
 flate2^1.0.131.0.25up to date
 futures-core^0.3.170.3.25up to date
 h2^0.3.90.3.15up to date
 http^0.2.50.2.8up to date
 httparse^1.5.11.8.0up to date
 httpdate^1.0.11.0.2up to date
 itoa^11.0.5up to date
 language-tags^0.30.3.2up to date
 local-channel^0.10.1.3up to date
 mime^0.30.3.16up to date
 percent-encoding^2.12.2.0up to date
 pin-project-lite^0.20.2.9up to date
 rand^0.80.8.5up to date
 sha1^0.100.10.5up to date
 smallvec^1.6.11.10.0up to date
 tokio ⚠️^1.18.41.24.2maybe insecure
 tokio-util^0.70.7.4up to date
 tracing^0.1.300.1.37up to date
 zstd^0.120.12.2+zstd.1.5.2up to date

Security Vulnerabilities

tokio: reject_remote_clients Configuration corruption

RUSTSEC-2023-0001

On Windows, configuring a named pipe server with pipe_mode will force ServerOptions::reject_remote_clients as false.

This drops any intended explicit configuration for the reject_remote_clients that may have been set as true previously.

The default setting of reject_remote_clients is normally true meaning the default is also overriden as false.

Workarounds

Ensure that pipe_mode is set first after initializing a ServerOptions. For example:

let mut opts = ServerOptions::new();
opts.pipe_mode(PipeMode::Message);
opts.reject_remote_clients(true);