CVE-2026-128242

Sažetak

actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.

Reference

https://github.com/actix/actix-web
https://github.com/actix/actix-web/blob/actix-http-v3.20.0/actix-http/src/encoding/decoder.rs#L239-L301
https://github.com/actix/actix-web/commit/0d0be61bd757027bfcecbc53df1b7a600f21ecd0
https://github.com/actix/actix-web/commit/41b54d23ea04f66758c15de7e4ab18325cd25280
https://github.com/actix/actix-web/releases/tag/actix-http-v3.20.1
https://github.com/actix/actix-web/releases/tag/actix-web-v4.18.2
https://github.com/actix/actix-web/security/advisories/GHSA-qph8-7859-gq2f
https://rustsec.org/advisories/RUSTSEC-2026-0448.html
https://www.vulncheck.com/advisories/actix-http-before-3.20.1-and-actix-web-before-4.18.2-decompression-bomb-dos-via-encoding-decoder

CVSS

Base:	7.5
Impact:	3.6
Exploitability:	3.9

Pristup

Vektor	Složenost	Autentikacija
NETWORK	LOW	NONE

Impact

Povjerljivost	Cjelovitost	Dostupnost
NONE	NONE	HIGH

CVSS vektor

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Zadnje važnije ažuriranje

13-11-2026 - 23:17

Objavljeno

13-11-2026 - 10:18