GHSA-7p9w-p5qm-5gc5
Large-window Brotli bodies bypass decompression memory limits
GHSA-7p9w-p5qm-5gc5 is a vulnerability with no CVSS score yet in actix-http, published November 6, 2026. No source lists public exploit code. Fixed in actix-http 3.20.3.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.20.3actix-http
Description
With the compress-brotli feature enabled, the decoder accepts the non-standard
large-window Brotli format. A crafted stream can cause its internal buffer to
grow to about 1 GiB before the decoded output reaches the configured size limit.
An 850-byte request can cause this allocation, and concurrent requests can
exhaust process or host memory.
Actix Web enables Brotli support by default. Applications that read request
bodies through Bytes, String, Json, or Form can be affected even when
extractor size limits are configured. The allocation occurs before the handler
runs, so authentication performed in the handler does not prevent it.
Upgrade to actix-http 3.20.3 or later. As a workaround, reject requests with
Content-Encoding: br at a reverse proxy or in middleware before body
extraction, or disable the compress-brotli feature throughout the dependency
graph.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
actix-httpcrates.io | 0.0.0-0 up to 3.20.3 | 3.20.3 |
What each source reports
OSVRUSTSEC-2026-0455No score
Large-window Brotli bodies bypass decompression memory limits
With the compress-brotli feature enabled, the decoder accepts the non-standard
large-window Brotli format. A crafted stream can cause its internal buffer to
grow to about 1 GiB before the decoded output reaches the configured size limit.
An 850-byte request can cause this allocation, and concurrent requests can
exhaust process or host memory.
Actix Web enables Brotli support by default. Applications that read request
bodies through Bytes, String, Json, or Form can be affected even when
extractor size limits are configured. The allocation occurs before the handler
runs, so authentication performed in the handler does not prevent it.
Upgrade to actix-http 3.20.3 or later. As a workaround, reject requests with
Content-Encoding: br at a reverse proxy or in middleware before body
extraction, or disable the compress-brotli feature throughout the dependency
graph.
- Record
RUSTSEC-2026-0455- Updated
- 2026-11-06
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.