Johntitor

**Name of the Vulnerable Software and Affected Versions** actix-files versions prior to 0.6.10 **Description** A denial of service issue exists when handling GET requests for static files. A remote attacker can crash the process on-demand by sending a GET request containing an empty `Range` header, provided that the panic behavior is configured to abort. **Recommendations** Update to version 0.6.10 or later.

**Name of the Vulnerable Software and Affected Versions** actix-files versions prior to 0.6.10 **Description** An information exposure issue exists when a non-existing folder is provided as the `serve from` argument to the `Files::new()` function. In this scenario, the mount path defaults to an empty path, and the service joins the request path with this empty path and canonicalizes it. This causes Rust to resolve the request as a relative path, allowing an attacker to request paths relative to the application's working directory and access unintended files. **Recommendations** Update actix-files to version 0.6.10 or later.