Reported

November 6, 2026

Issued

November 6, 2026

Package

actix-http (crates.io)

Type

Vulnerability

Categories

• denial-of-service

Aliases

• GHSA-qph8-7859-gq2f

References

• https://github.com/actix/actix-web/commit/41b54d23ea04f66758c15de7e4ab18325cd25280

Patched

• >=3.20.1

Description

The encoding::Decoder stream can expand compressed input into a large output buffer before a caller can enforce its body size limit. An attacker who controls a compressed request or response can cause excessive memory allocation and CPU use, resulting in denial of service.

This affects applications that decode untrusted gzip, deflate, Brotli, or Zstandard bodies with the corresponding compression feature enabled.

Upgrade to actix-http 3.20.1 or later and configure Decoder::limit() when using the decoder directly. Actix Web users must also upgrade to actix-web 4.18.2 or later so that extractors pass their limits to the decoder.

Advisory available under CC0-1.0 license.