Executive Summary

CVE-2026-49755 is a decompression bomb denial-of-service vulnerability in the Req library for Elixir/Erlang. It occurs because the library's default response pipeline automatically decodes and decompresses archive files (ZIP, TAR, GZIP) and content-encoded responses without enforcing size limits.

An attacker-controlled HTTP server can send a small compressed response (under 1MB) that expands to multiple gigabytes when decompressed by the Req client, exhausting memory and crashing the BEAM process.

The vulnerability arises from improper handling of highly compressed data, where no per-entry or total size caps are enforced during decompression.

Useful 0 Not Useful 0

Compliance Impact

CVE-2026-49755 is a denial-of-service vulnerability that can crash the BEAM runtime by exhausting memory through decompression bombs in the Req library. This primarily impacts system availability.

While the vulnerability does not directly disclose or manipulate personal or sensitive data, the resulting denial of service could affect the availability of systems processing regulated data under standards like GDPR or HIPAA.

Disruptions caused by this vulnerability could lead to non-compliance with availability requirements in such regulations, potentially impacting service continuity and data processing obligations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a denial-of-service condition by exhausting the memory of the Req client application.

A malicious server can send a small compressed response that expands massively in memory, causing the BEAM runtime to crash and potentially impacting all workloads running on the same VM.

The attack requires no authentication and can affect any Elixir application using Req with its default pipeline to fetch URLs from untrusted sources, such as webhooks, link previews, OAuth clients, and redirects.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves monitoring for unusually large memory usage or crashes in applications using the Req library versions from 0.1.0 to before 0.6.1 when processing HTTP responses.

Since the vulnerability is triggered by attacker-controlled HTTP servers sending highly compressed response bodies that decompress into very large sizes, you can look for requests to untrusted or suspicious URLs that return compressed content types such as application/zip, application/x-tar, or application/gzip.

Commands to detect potential exploitation attempts could include monitoring logs for requests made by Req clients to suspicious endpoints and checking memory usage of the BEAM process.

• Use system monitoring tools like `top`, `htop`, or `ps` to observe BEAM process memory spikes.
• Check application logs for HTTP responses with content-type headers indicating compressed archives (e.g., application/zip, application/x-tar, application/gzip).
• Use network monitoring tools like `tcpdump` or `wireshark` to capture HTTP traffic and filter for suspicious content-encoding or content-type headers.
• If you have access to the application code or runtime, add logging around Req client calls to record response headers and sizes.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include disabling automatic response body decoding and decompression in the Req client when making requests to untrusted URLs.

Specifically, update the Req library to version 0.6.1 or later, where automatic decompression is disabled by default and must be explicitly enabled with the `compressed: true` option.

If upgrading is not immediately possible, configure your Req client to use the `:raw` option to disable both decompression and decoding of response bodies.

• Upgrade Req library to version 0.6.1 or later.
• Disable automatic decompression by not setting `compressed: true` in Req requests.
• Use the `:raw` option in Req requests to avoid decompression and decoding.
• Avoid making requests to untrusted or attacker-controlled servers using Req without these mitigations.

Useful 0 Not Useful 0