RUSTSEC-2026-0455

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0455

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0455.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0455

Aliases

GHSA-7p9w-p5qm-5gc5

Published

2026-11-06T12:00:00Z

Modified

2026-11-06T15:45:02Z

Summary

Large-window Brotli bodies bypass decompression memory limits

Details

With the compress-brotli feature enabled, the decoder accepts the non-standard large-window Brotli format. A crafted stream can cause its internal buffer to grow to about 1 GiB before the decoded output reaches the configured size limit. An 850-byte request can cause this allocation, and concurrent requests can exhaust process or host memory.

Actix Web enables Brotli support by default. Applications that read request bodies through Bytes, String, Json, or Form can be affected even when extractor size limits are configured. The allocation occurs before the handler runs, so authentication performed in the handler does not prevent it.

Upgrade to actix-http 3.20.3 or later. As a workaround, reject requests with Content-Encoding: br at a reverse proxy or in middleware before body extraction, or disable the compress-brotli feature throughout the dependency graph.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / actix-http

Package

Name: actix-http; View open source insights on deps.dev
Purl: pkg:cargo/actix-http

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

3.20.3

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}