GHSA-qph8-7859-gq2f json
Unbounded decompression can exhaust memory and CPU resources
published 2026-11-06 2 d ago modified 2026-11-06 2 d ago also RUSTSEC-2026-0447 , RUSTSEC-2026-0448
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
The `encoding::Decoder` stream can expand compressed input into a large output buffer before a caller can enforce its body size limit. An attacker who controls a compressed request or response can cause excessive memory allocation and CPU use, resulting in denial of service.
This affects applications that decode untrusted gzip, deflate, Brotli, or Zstandard bodies with the corresponding compression feature enabled.
Upgrade to actix-http 3.20.1 or later and configure `Decoder::limit()` when using the decoder directly. Actix Web users must also upgrade to actix-web 4.18.2 or later so that extractors pass their limits to the decoder.
Patch / fix
- crates.io actix-http 3.20.1
- crates.io actix-web 4.18.2
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | actix-http | >=0.0.0-0, <3.20.1 |
3.20.1 |
| crates.io | actix-web | >=0.0.0-0, <4.18.2 |
4.18.2 |
References
-
github.com
/actix/actix-web/commit/41b54d23ea04f66758c15de7e4ab18325cd25280
web
-
github.com
/actix/actix-web/commit/0d0be61bd757027bfcecbc53df1b7a600f21ecd0
web
-
crates.io
/crates/actix-http
package
-
rustsec.org
/advisories/RUSTSEC-2026-0448.html
advisory
-
crates.io
/crates/actix-web
package
-
rustsec.org
/advisories/RUSTSEC-2026-0447.html
advisory
Sources
- OSV RUSTSEC-2026-0448
- OSV RUSTSEC-2026-0447
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.