CVE-2026-128242

Description

actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.

References

https://www.vulncheck.com/advisories/actix-http-before-3.20.1-and-actix-web-before-4.18.2-decompression-bomb-dos-via-encoding-decoder

https://rustsec.org/advisories/RUSTSEC-2026-0448.html

https://github.com/actix/actix-web/security/advisories/GHSA-qph8-7859-gq2f

https://github.com/actix/actix-web/releases/tag/actix-web-v4.18.2

https://github.com/actix/actix-web/releases/tag/actix-http-v3.20.1

https://github.com/actix/actix-web/commit/41b54d23ea04f66758c15de7e4ab18325cd25280

https://github.com/actix/actix-web/commit/0d0be61bd757027bfcecbc53df1b7a600f21ecd0

https://github.com/actix/actix-web/blob/actix-http-v3.20.0/actix-http/src/encoding/decoder.rs#L239-L301

https://github.com/actix/actix-web

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-125050

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4

EPSS