Reported

November 6, 2026

Issued

November 6, 2026

Package

actix-web (crates.io)

Type

Vulnerability

Categories

• denial-of-service

Aliases

• GHSA-qph8-7859-gq2f

References

• https://github.com/actix/actix-web/commit/0d0be61bd757027bfcecbc53df1b7a600f21ecd0

Patched

• >=4.18.2

Description

Body extractors do not pass their size limits to the decompression layer. A small compressed request can therefore cause a large allocation before the extractor rejects the decoded body. A remote attacker can use this to exhaust memory or CPU resources and cause denial of service.

This affects applications that read compressed request bodies with the corresponding compression feature enabled.

Upgrade to actix-web 4.18.2 or later with actix-http 3.20.1 or later. As a workaround, reject compressed request bodies at a reverse proxy or in middleware before body extraction.

Advisory available under CC0-1.0 license.