{"id":"CVE-2026-128242","aliases":["EUVD-2026-125050","GHSA-gxj9-vqfq-hp64","GHSA-qph8-7859-gq2f","RUSTSEC-2026-0447","RUSTSEC-2026-0448","UBUNTU-CVE-2026-128242"],"status":"published","title":"actix-http before 3.20.1 and actix-web before 4.18.2 Decompression Bomb DoS via encoding::Decoder","description":"actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-13","score":0.00956,"percentile":0.61948,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-409"],"published":"2026-11-06T12:00:00Z","modified":"2026-11-14T02:55:46Z","fixes":[{"ecosystem":"crates.io","package":"actix-web","fixed_in":["4.18.2"],"sources":["osv"]},{"ecosystem":"crates.io","package":"actix-http","fixed_in":["3.20.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"actix-web","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"4.18.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"actix-http","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"3.20.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-actix-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.11.2-2","3.12.0-1","3.13.1-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-actix-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.9.0-3","3.11.2-1","3.11.2-2"]}],"products":[{"vendor":"actix","product":"actix-http"},{"vendor":"actix","product":"actix-web"}],"references":[{"url":"https://github.com/actix/actix-web/security/advisories/GHSA-qph8-7859-gq2f","tags":["vendor-advisory","advisory","report"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0448.html","tags":["third-party-advisory","advisory","report"]},{"url":"https://github.com/actix/actix-web/commit/41b54d23ea04f66758c15de7e4ab18325cd25280","tags":["patch","fix","web","report"]},{"url":"https://github.com/actix/actix-web/commit/0d0be61bd757027bfcecbc53df1b7a600f21ecd0","tags":["patch","fix","web","report"]},{"url":"https://github.com/actix/actix-web/blob/actix-http-v3.20.0/actix-http/src/encoding/decoder.rs#L239-L301","tags":["technical-description","article","report"]},{"url":"https://github.com/actix/actix-web/releases/tag/actix-http-v3.20.1","tags":["release-notes","advisory","report"]},{"url":"https://github.com/actix/actix-web/releases/tag/actix-web-v4.18.2","tags":["release-notes","advisory","report"]},{"url":"https://github.com/actix/actix-web","tags":["product","package","report"]},{"url":"https://www.vulncheck.com/advisories/actix-http-before-3.20.1-and-actix-web-before-4.18.2-decompression-bomb-dos-via-encoding-decoder","tags":["third-party-advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128242","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gxj9-vqfq-hp64"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128242.json","tags":["advisory"]},{"url":"https://crates.io/crates/actix-web","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0447.html","tags":["advisory"]},{"url":"https://crates.io/crates/actix-http","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-128242","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-128242","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-128242","title":"actix-http before 3.20.1 and actix-web before 4.18.2 Decompression Bomb DoS via encoding::Decoder","description":"actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.","status":"published","published":"2026-11-13T09:33:45.553Z","modified":"2026-11-13T22:31:21.483Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-409"],"updated_at":"2026-11-13T10:27:12.71329Z"}],"euvd":[{"id":"EUVD-2026-125050","description":"actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.","status":"published","published":"2026-11-13T09:33:45Z","modified":"2026-11-13T22:31:21Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-13T14:38:52.540051Z"}],"ghsa":[{"id":"GHSA-gxj9-vqfq-hp64","title":"actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression...","description":"actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.","status":"published","published":"2026-11-13T12:31:40Z","modified":"2026-11-13T12:31:48Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-409"],"updated_at":"2026-11-13T12:50:18.307659Z"}],"nvd":[{"id":"CVE-2026-128242","description":"actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.","status":"published","published":"2026-11-13T10:18:12.18Z","modified":"2026-11-13T23:17:18.353Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-409"],"updated_at":"2026-11-14T01:39:04.528785Z"}],"osv":[{"id":"CVE-2026-128242","title":"actix-http before 3.20.1 and actix-web before 4.18.2 Decompression Bomb DoS via encoding::Decoder","description":"actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.","status":"published","published":"2026-11-13T09:33:45.553Z","modified":"2026-11-14T10:30:55.76992472Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-409"],"updated_at":"2026-11-14T03:11:06.681237Z"},{"id":"UBUNTU-CVE-2026-128242","description":"actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.","status":"published","published":"2026-11-13T00:00:00Z","modified":"2026-11-13T21:05:41.571916087Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-13T21:30:20.292037Z"},{"id":"RUSTSEC-2026-0447","title":"Compressed request bodies can exhaust memory before extractor limits apply","description":"Body extractors do not pass their size limits to the decompression layer.\nA small compressed request can therefore cause a large allocation before the\nextractor rejects the decoded body. A remote attacker can use this to exhaust\nmemory or CPU resources and cause denial of service.\n\nThis affects applications that read compressed request bodies with the\ncorresponding compression feature enabled.\n\nUpgrade to actix-web 4.18.2 or later with actix-http 3.20.1 or later.\nAs a workaround, reject compressed request bodies at a reverse proxy or in\nmiddleware before body extraction.","status":"published","published":"2026-11-06T12:00:00Z","modified":"2026-11-14T02:55:46.289522173Z","updated_at":"2026-11-14T03:11:06.681237Z"},{"id":"RUSTSEC-2026-0448","title":"Unbounded decompression can exhaust memory and CPU resources","description":"The `encoding::Decoder` stream can expand compressed input into a large output\nbuffer before a caller can enforce its body size limit. An attacker who controls\na compressed request or response can cause excessive memory allocation and CPU\nuse, resulting in denial of service.\n\nThis affects applications that decode untrusted gzip, deflate, Brotli, or Zstandard\nbodies with the corresponding compression feature enabled.\n\nUpgrade to actix-http 3.20.1 or later and configure `Decoder::limit()` when using\nthe decoder directly. Actix Web users must also upgrade to actix-web 4.18.2 or\nlater so that extractors pass their limits to the decoder.","status":"published","published":"2026-11-06T12:00:00Z","modified":"2026-11-14T02:55:46.289522173Z","updated_at":"2026-11-14T03:11:06.681237Z"}]}}