CVE-2026-128242 · Package
NO FIX YET · SEE WHAT TO DO
actix-http and actix-web decompress gzip, deflate, Brotli and zstd request bodies without a size limit. A remote attacker can send a small, highly compressed body that expands into a huge one, exhausting server memory and CPU.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Rust services built on actix-web or actix-http that accept compressed request bodies through Json, Form, Bytes or String extractors, or that use awc clients against untrusted servers. Services that do not accept compressed request bodies from untrusted clients are less exposed.
Not affected if internal-only-clients, no-compressed-request-bodies
Who cares actix-http, actix-web, awc, rust
actix-web and actix-http in Cargo.lock (e.g. cargo tree -p actix-web).Json, Form, Bytes or String extractors, or awc clients, that accept compressed request bodies.actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
actix-http 3.20.1 or lateractix-web 4.18.2 or laterThis page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.