Every CVESearch/Get API key

CVE-2026-128242

actix-http before 3.20.1 and actix-web before 4.18.2 Decompression Bomb DoS via encoding::Decoder

8.7 HighFix available

CVE-2026-128242 is a high vulnerability (CVSS 8.7) in Actix Actix-http, published November 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.93%, the 61st percentile. Fixed in actix-web 4.18.2.

What does this mean?
Severity
8.7 HighCVSS 4.0, CVE List
Exploit chance
0.93%EPSS, 61st percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
4.18.2actix-web +3 more

Description

actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.93%Unchanged since Nov 13, 2026
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
actix-web
crates.io
0.0.0-0 up to 4.18.2
4.18.2
actix-http
crates.io
0.0.0-0 up to 3.20.1
3.20.1
rust-actix-http
Ubuntu:26.10
All versions, plus listed versions
3.11.2-23.12.0-13.13.1-2
None known
rust-actix-http
Ubuntu:26.04:LTS
All versions, plus listed versions
3.9.0-33.11.2-13.11.2-2
None known

What each source reports

CVE List Score used8.7

actix-http before 3.20.1 and actix-web before 4.18.2 Decompression Bomb DoS via encoding::Decoder

actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.

Record
CVE-2026-128242
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-409
Updated
2026-11-13
EUVDEUVD-2026-1250508.7

actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.

Record
EUVD-2026-125050
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-13
GitHub AdvisoriesGHSA-gxj9-vqfq-hp648.7

actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression...

actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.

Record
GHSA-gxj9-vqfq-hp64
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-409
Updated
2026-11-13
NVD8.7

actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.

Record
CVE-2026-128242
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-409
Updated
2026-11-14
OSV8.7

actix-http before 3.20.1 and actix-web before 4.18.2 Decompression Bomb DoS via encoding::Decoder

actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.

Record
CVE-2026-128242
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-409
Updated
2026-11-15
OSVUBUNTU-CVE-2026-1282428.7

actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.

Record
UBUNTU-CVE-2026-128242
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-13
OSVRUSTSEC-2026-0447No score

Compressed request bodies can exhaust memory before extractor limits apply

Body extractors do not pass their size limits to the decompression layer. A small compressed request can therefore cause a large allocation before the extractor rejects the decoded body. A remote attacker can use this to exhaust memory or CPU resources and cause denial of service.

This affects applications that read compressed request bodies with the corresponding compression feature enabled.

Upgrade to actix-web 4.18.2 or later with actix-http 3.20.1 or later. As a workaround, reject compressed request bodies at a reverse proxy or in middleware before body extraction.

Record
RUSTSEC-2026-0447
Updated
2026-11-14
OSVRUSTSEC-2026-0448No score

Unbounded decompression can exhaust memory and CPU resources

The encoding::Decoder stream can expand compressed input into a large output buffer before a caller can enforce its body size limit. An attacker who controls a compressed request or response can cause excessive memory allocation and CPU use, resulting in denial of service.

This affects applications that decode untrusted gzip, deflate, Brotli, or Zstandard bodies with the corresponding compression feature enabled.

Upgrade to actix-http 3.20.1 or later and configure Decoder::limit() when using the decoder directly. Actix Web users must also upgrade to actix-web 4.18.2 or later so that extractors pass their limits to the decoder.

Record
RUSTSEC-2026-0448
Updated
2026-11-14

History

History
RecordedChangedSources
affected, aliases, facts, published, referencesNVD, OSV
affected, aliases, published, referencesOSV
publishedEUVD
publishedEUVD
aliases, referencesGitHub Advisories, NVD
aliases, publishedEUVD
first indexedCVE List
first indexedOSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 11 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open