Actix
CVE-2026-128242: actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust me
CVE-2026-128242 Nov 13, 2026 Source: Vendor
actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-128242
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
4 lines
Showing 1–4 of 4
CVE-2026-128242
BR2026-0000-048376
unclaimed
Credited as Stapat
CVE-2026-128242
BR2026-0000-048377
unclaimed
Credited as diandiandia
CVE-2026-128242
BR2026-0000-048378
unclaimed
Credited as lboynton
CVE-2026-128242
BR2026-0000-048379
unclaimed
Credited as calbebop