RUSTSEC-2026-0448

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0448

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0448.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0448

Aliases

GHSA-qph8-7859-gq2f
RUSTSEC-2026-0447

Published

2026-11-06T12:00:00Z

Modified

2026-11-06T14:56:05Z

Summary

Unbounded decompression can exhaust memory and CPU resources

Details

The encoding::Decoder stream can expand compressed input into a large output buffer before a caller can enforce its body size limit. An attacker who controls a compressed request or response can cause excessive memory allocation and CPU use, resulting in denial of service.

This affects applications that decode untrusted gzip, deflate, Brotli, or Zstandard bodies with the corresponding compression feature enabled.

Upgrade to actix-http 3.20.1 or later and configure Decoder::limit() when using the decoder directly. Actix Web users must also upgrade to actix-web 4.18.2 or later so that extractors pass their limits to the decoder.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / actix-http

Package

Name: actix-http; View open source insights on deps.dev
Purl: pkg:cargo/actix-http

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

3.20.1

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}