CVE-2026-128242

EUVD-2026-125050
actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.
Data Amplification
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 61.95%
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
rust-actix-http
jammy
dne
noble
dne
resolute
needs-triage
stonking
needs-triage
Common Weakness Enumeration
References
https://github.com/actix/actix-web
https://github.com/actix/actix-web/blob/actix-http-v3.20.0/actix-http/src/encoding/decoder.rs#L239-L301
https://github.com/actix/actix-web/commit/0d0be61bd757027bfcecbc53df1b7a600f21ecd0
https://github.com/actix/actix-web/commit/41b54d23ea04f66758c15de7e4ab18325cd25280
https://github.com/actix/actix-web/releases/tag/actix-http-v3.20.1
https://github.com/actix/actix-web/releases/tag/actix-web-v4.18.2
https://github.com/actix/actix-web/security/advisories/GHSA-qph8-7859-gq2f
https://rustsec.org/advisories/RUSTSEC-2026-0448.html
https://www.vulncheck.com/advisories/actix-http-before-3.20.1-and-actix-web-before-4.18.2-decompression-bomb-dos-via-encoding-decoder