Reported

November 6, 2026

Issued

November 6, 2026

Package

actix-http (crates.io)

Type

Vulnerability

Categories

• denial-of-service

Aliases

• GHSA-7p9w-p5qm-5gc5

References

• https://github.com/actix/actix-web/commit/61c6a15c1c0e505a5cd6842610a5f1faea432a83

Patched

• >=3.20.3

Description

With the compress-brotli feature enabled, the decoder accepts the non-standard large-window Brotli format. A crafted stream can cause its internal buffer to grow to about 1 GiB before the decoded output reaches the configured size limit. An 850-byte request can cause this allocation, and concurrent requests can exhaust process or host memory.

Actix Web enables Brotli support by default. Applications that read request bodies through Bytes, String, Json, or Form can be affected even when extractor size limits are configured. The allocation occurs before the handler runs, so authentication performed in the handler does not prevent it.

Upgrade to actix-http 3.20.3 or later. As a workaround, reject requests with Content-Encoding: br at a reverse proxy or in middleware before body extraction, or disable the compress-brotli feature throughout the dependency graph.

Advisory available under CC0-1.0 license.