RUSTSEC-2026-0447

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0447

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0447.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0447

Aliases

GHSA-qph8-7859-gq2f
RUSTSEC-2026-0448

Published

2026-11-06T12:00:00Z

Modified

2026-11-06T14:56:05Z

Summary

Compressed request bodies can exhaust memory before extractor limits apply

Details

Body extractors do not pass their size limits to the decompression layer. A small compressed request can therefore cause a large allocation before the extractor rejects the decoded body. A remote attacker can use this to exhaust memory or CPU resources and cause denial of service.

This affects applications that read compressed request bodies with the corresponding compression feature enabled.

Upgrade to actix-web 4.18.2 or later with actix-http 3.20.1 or later. As a workaround, reject compressed request bodies at a reverse proxy or in middleware before body extraction.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / actix-web

Package

Name: actix-web; View open source insights on deps.dev
Purl: pkg:cargo/actix-web

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

4.18.2

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}