ETK-2026-3874Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-3874",
  "cve_id": null,
  "display_id": "ETK-2026-3874",
  "ghsa_id": "GHSA-48p4-xj33-4fw4",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Unlimited multipart parts cause resource exhaustion in actix-multipart",
  "summary": "actix-multipart before 0.8.7 does not bound the number of parts accepted by MultipartForm. An unauthenticated remote client can exhaust memory or file descriptors when an exposed endpoint processes multipart requests with multi-value or multi-file fields.",
  "mitigation": "Upgrade actix-multipart to >= 0.8.7 or later.",
  "vendor": "rust",
  "product": "rust:actix-multipart",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 0.8.7"
      ],
      "ecosystem": "rust",
      "fixed_versions": [
        ">= 0.8.7"
      ],
      "package_name": "actix-multipart",
      "purl": "pkg:cargo/actix-multipart"
    }
  ],
  "cwes": [
    770
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 18.678411016666665,
  "t0_at": null,
  "signals": {
    "public_poc": {
      "at": "2026-11-08T02:22:17+00:00",
      "days": -0.2671216586921296,
      "is_lower_bound": true,
      "measured_at": "2026-11-08T08:46:56.367687+00:00",
      "url": "https://github.com/actix/actix-web/security/advisories/GHSA-48p4-xj33-4fw4"
    },
    "trigger_signal": {
      "at": "2026-11-08T02:22:17+00:00",
      "days": -0.2671216586921296,
      "is_lower_bound": true,
      "measured_at": "2026-11-08T08:46:56.367687+00:00",
      "url": "https://github.com/actix/actix-web/security/advisories/GHSA-48p4-xj33-4fw4"
    }
  }
}