CVE-2026-128242
Received Received - Intake

actix-web Unbounded Decompression Memory Exhaustion Vulnerability

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128242
EUVD
EUVD-2026-125050

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
actix actix-http From 0 (inc) to 3.20.1 (exc)
actix actix-web From 0 (inc) to 4.18.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unbounded decompression issue in actix-http before 3.20.1 and actix-web before 4.18.2. It allows remote attackers to exhaust memory and CPU resources by sending small, highly compressed request bodies using formats like gzip, deflate, Brotli, or zstd. The attack targets Json, Form, Bytes, or String extractors or awc clients, leading to denial of service.

Detection Guidance

To detect this vulnerability, monitor for unusually high CPU or memory usage from processes handling HTTP requests, particularly those using actix-web or actix-http libraries. Check for repeated requests with compressed payloads (gzip, deflate, Brotli, zstd) that are small in size but cause resource exhaustion. Inspect server logs for failed requests or timeouts during decompression.

Impact Analysis

This vulnerability can impact you by causing your application to become unresponsive or crash due to excessive memory and CPU usage. If exploited, it may lead to denial of service, disrupting services for legitimate users and potentially causing downtime.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing service disruptions that lead to data processing delays or unavailability. GDPR requires timely data processing, while HIPAA mandates continuous access to protected health information. Exploits may result in violations if critical systems are unavailable.

Mitigation Strategies
  • Upgrade actix-http to version 3.20.1 or later and actix-web to version 4.18.2 or later to patch the unbounded decompression issue.
  • Implement rate limiting on your web server to prevent excessive requests that could trigger resource exhaustion.
  • Disable or restrict support for compressed request bodies (gzip, deflate, Brotli, zstd) if not required for your application.
  • Monitor network traffic for suspicious patterns, such as repeated small compressed payloads sent to vulnerable endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128242. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...