CVE-2026-128242: actix-http before 3.20.1 and actix-web before 4.18.2 Decompression Bomb DoS via encoding::Decoder

Q: Which deployments are exposed to this denial-of-service issue?

Applications using vulnerable actix-http or actix-web versions are exposed when they accept compressed request bodies through Json, Form, Bytes, or String extractors. awc clients using affected versions can also be affected when they consume compressed responses from a server.

Q: What does an attacker need to exploit the vulnerability?

An attacker needs network access to send a compressed request body to an affected application endpoint, or to make an affected awc client process a compressed response. No authentication or user interaction is required.

Q: Which content encodings can be used in an attack?

The affected decoder can be abused with gzip, deflate, Brotli, or zstd compressed bodies. A small compressed payload can expand without bounds and consume memory and CPU.

Q: What versions resolve the issue?

Upgrade actix-http to 3.20.1 or later, and actix-web to 4.18.2 or later. The provided data does not identify a separate mitigation for systems that cannot upgrade immediately.

Published Nov 13, 2026

Updated

actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.

Affected Software

2 affected components

cargo/actix-http<3.20.1

cargo/actix-web<4.18.2

Event History

Nov 13, 2026

CVE Published

via MITRE·09:33 AM

Data Sourced

via MITRE·09:33 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:18 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

Applications using vulnerable actix-http or actix-web versions are exposed when they accept compressed request bodies through Json, Form, Bytes, or String extractors. awc clients using affected versions can also be affected when they consume compressed responses from a server.

What does an attacker need to exploit the vulnerability?

An attacker needs network access to send a compressed request body to an affected application endpoint, or to make an affected awc client process a compressed response. No authentication or user interaction is required.

Which content encodings can be used in an attack?

The affected decoder can be abused with gzip, deflate, Brotli, or zstd compressed bodies. A small compressed payload can expand without bounds and consume memory and CPU.

What versions resolve the issue?

Upgrade actix-http to 3.20.1 or later, and actix-web to 4.18.2 or later. The provided data does not identify a separate mitigation for systems that cannot upgrade immediately.

CVE-2026-128242: actix-http before 3.20.1 and actix-web before 4.18.2 Decompression Bomb DoS via encoding::Decoder

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

What does an attacker need to exploit the vulnerability?

Which content encodings can be used in an attack?

What versions resolve the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

What does an attacker need to exploit the vulnerability?

Which content encodings can be used in an attack?

What versions resolve the issue?