{"id":"CVE-2026-128242","kind":"vulnerability","aliases":["CVE-2026-128242"],"related":[],"title":"actix-web: unbounded decompression lets small request bodies exhaust memory","description":"actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.","summary":"actix-http and actix-web decompress gzip, deflate, Brotli and zstd request bodies without a size limit. A remote attacker can send a small, highly compressed body that expands into a huge one, exhausting server memory and CPU.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["actix-http","actix-web","awc","package","rust"],"not_affected_if":["internal-only-clients","no-compressed-request-bodies"],"how_to_check":"- Check the locked version of `actix-web` and `actix-http` in `Cargo.lock` (e.g. `cargo tree -p actix-web`).\n- Look for `Json`, `Form`, `Bytes` or `String` extractors, or `awc` clients, that accept compressed request bodies.","fix":"- `actix-http` `3.20.1` or later\n- `actix-web` `4.18.2` or later","status":"open","published_at":"2026-11-13T10:18:12+00:00","first_seen_at":"2026-11-13T10:47:33+00:00","triaged_at":"2026-11-13T10:50:18+00:00","updated_at":"2026-11-13T10:50:18+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T10:50:18Z","model":"claude-haiku-5-5","output":{"fix":"- `actix-http` `3.20.1` or later\n- `actix-web` `4.18.2` or later","reach":"internet","title":"actix-web: unbounded decompression lets small request bodies exhaust memory","impact":"medium","summary":"actix-http and actix-web decompress gzip, deflate, Brotli and zstd request bodies without a size limit. A remote attacker can send a small, highly compressed body that expands into a huge one, exhausting server memory and CPU.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","actix-web","actix-http","awc"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Remote denial of service through memory and CPU exhaustion","analyst_note":"","how_to_check":"- Check the locked version of `actix-web` and `actix-http` in `Cargo.lock` (e.g. `cargo tree -p actix-web`).\n- Look for `Json`, `Form`, `Bytes` or `String` extractors, or `awc` clients, that accept compressed request bodies.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-compressed-request-bodies","internal-only-clients"],"who_is_affected":"Rust services built on actix-web or actix-http that accept compressed request bodies through Json, Form, Bytes or String extractors, or that use awc clients against untrusted servers. Services that do not accept compressed request bodies from untrusted clients are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000745,"input_tokens":4691,"output_tokens":552,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-128242':14A,17A '-2026':13A,16A '3.20.1':71C '4.18.2':77C 'actix':2A,19B,22B,28B,32B,68C,74C 'actix-http':18B,27B,67C 'actix-web':1A,21B,31B,73C 'attack':48B,89C,97C 'awc':24B,121C 'bodi':9A,41B,55B,96C,109C 'brot':37B,105C 'byte':113C 'caus':123C 'client':122C 'compress':54B,95C,102C 'contain':78C 'cpu':66B,93C 'cve':12A,15A 'decod':85C 'decompress':5A,34B,81C 'deflat':36B,104C 'denial':124C 'encod':84C 'exhaust':10A,62B,90C 'expand':57B 'extractor':116C 'form':112C 'gzip':35B,103C 'high':53B,101C 'http':20B,29B,69C 'huge':60B 'json':111C 'let':6A,87C 'limit':45B 'memori':11A,64B,91C 'one':61B 'packag':25B 'remot':47B,88C 'request':8A,40B,108C 'rust':26B 'send':50B,99C 'serv':118C 'server':63B 'servic':126C 'size':44B 'small':7A,52B,100C 'string':115C 'unbound':4A,80C 'via':94C 'vulner':82C 'web':3A,23B,33B,75C 'without':42B 'zstd':39B,107C","nicknames":[],"mitigations":[],"who_affected":"Rust services built on actix-web or actix-http that accept compressed request bodies through Json, Form, Bytes or String extractors, or that use awc clients against untrusted servers. Services that do not accept compressed request bodies from untrusted clients are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["actixhttp","actixweb","awc","high","package","rust"],"campaign_type":null,"search_a":"'-128242':14A,17A '-2026':13A,16A 'actix':2A 'actix-web':1A 'bodi':9A 'cve':12A,15A 'decompress':5A 'exhaust':10A 'let':6A 'memori':11A 'request':8A 'small':7A 'unbound':4A 'web':3A","search_b":"'actix':19B,22B,28B,32B 'actix-http':18B,27B 'actix-web':21B,31B 'attack':48B 'awc':24B 'bodi':41B,55B 'brot':37B 'compress':54B 'cpu':66B 'decompress':34B 'deflat':36B 'exhaust':62B 'expand':57B 'gzip':35B 'high':53B 'http':20B,29B 'huge':60B 'limit':45B 'memori':64B 'one':61B 'packag':25B 'remot':47B 'request':40B 'rust':26B 'send':50B 'server':63B 'size':44B 'small':52B 'web':23B,33B 'without':42B 'zstd':39B","search_c":"'3.20.1':71C '4.18.2':77C 'actix':68C,74C 'actix-http':67C 'actix-web':73C 'attack':89C,97C 'awc':121C 'bodi':96C,109C 'brot':105C 'byte':113C 'caus':123C 'client':122C 'compress':95C,102C 'contain':78C 'cpu':93C 'decod':85C 'decompress':81C 'deflat':104C 'denial':124C 'encod':84C 'exhaust':90C 'extractor':116C 'form':112C 'gzip':103C 'high':101C 'http':69C 'json':111C 'let':87C 'memori':91C 'remot':88C 'request':108C 'send':99C 'serv':118C 'servic':126C 'small':100C 'string':115C 'unbound':80C 'via':94C 'vulner':82C 'web':75C 'zstd':107C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-06T12:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128242","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128242","severity":null,"published_at":"2026-11-13T10:18:12+00:00","modified_at":"2026-11-13T10:18:12+00:00","first_seen_at":"2026-11-13T10:47:33+00:00","fetched_at":"2026-11-13T10:47:33+00:00","note":null}],"documents":[{"id":145433,"url":"https://github.com/actix/actix-web/commit/0d0be61bd757027bfcecbc53df1b7a600f21ecd0","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145434,"url":"https://github.com/actix/actix-web/commit/41b54d23ea04f66758c15de7e4ab18325cd25280","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145435,"url":"https://github.com/actix/actix-web/releases/tag/actix-http-v3.20.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":145436,"url":"https://github.com/actix/actix-web/releases/tag/actix-web-v4.18.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":145437,"url":"https://github.com/actix/actix-web/security/advisories/GHSA-qph8-7859-gq2f","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-06T12:17:07+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145438,"url":"https://www.vulncheck.com/advisories/actix-http-before-3.20.1-and-actix-web-before-4.18.2-decompression-bomb-dos-via-encoding-decoder","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}