{"affected":[{"defaultStatus":"unaffected","ecosystem":"cargo","packageName":"actix-http","product":"actix-http","source":"CNA: VulnCheck","vendor":"actix","versions":[{"lessThan":"3.20.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"cargo","packageName":"actix-web","product":"actix-web","source":"CNA: VulnCheck","vendor":"actix","versions":[{"lessThan":"4.18.2","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-128242","cwes":["CWE-409"],"description":"actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.7,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"},{"score":7.5,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},{"score":8.7,"severity":"high","source":"NVD: disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"},{"score":7.5,"severity":"high","source":"NVD: disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1794565092180,"publishedAt":1794562425553,"references":[{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/actix/actix-web/security/advisories/GHSA-qph8-7859-gq2f"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://rustsec.org/advisories/RUSTSEC-2026-0448.html"},{"source":"CNA: VulnCheck","tags":["patch"],"url":"https://github.com/actix/actix-web/commit/41b54d23ea04f66758c15de7e4ab18325cd25280"},{"source":"CNA: VulnCheck","tags":["patch"],"url":"https://github.com/actix/actix-web/commit/0d0be61bd757027bfcecbc53df1b7a600f21ecd0"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://github.com/actix/actix-web/blob/actix-http-v3.20.0/actix-http/src/encoding/decoder.rs#L239-L301"},{"source":"CNA: VulnCheck","tags":["release-notes"],"url":"https://github.com/actix/actix-web/releases/tag/actix-http-v3.20.1"},{"source":"CNA: VulnCheck","tags":["release-notes"],"url":"https://github.com/actix/actix-web/releases/tag/actix-web-v4.18.2"},{"source":"CNA: VulnCheck","tags":["product"],"url":"https://github.com/actix/actix-web"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/actix-http-before-3.20.1-and-actix-web-before-4.18.2-decompression-bomb-dos-via-encoding-decoder"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/actix/actix-web"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/actix/actix-web/blob/actix-http-v3.20.0/actix-http/src/encoding/decoder.rs#L239-L301"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/actix/actix-web/commit/0d0be61bd757027bfcecbc53df1b7a600f21ecd0"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/actix/actix-web/commit/41b54d23ea04f66758c15de7e4ab18325cd25280"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/actix/actix-web/releases/tag/actix-http-v3.20.1"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/actix/actix-web/releases/tag/actix-web-v4.18.2"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/actix/actix-web/security/advisories/GHSA-qph8-7859-gq2f"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://rustsec.org/advisories/RUSTSEC-2026-0448.html"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://www.vulncheck.com/advisories/actix-http-before-3.20.1-and-actix-web-before-4.18.2-decompression-bomb-dos-via-encoding-decoder"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/actix/actix-web/commit/41b54d23ea04f66758c15de7e4ab18325cd25280"},{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/actix/actix-web/commit/0d0be61bd757027bfcecbc53df1b7a600f21ecd0"}],"revision":"7a7e239ffd67d1af1d267a57f70bcb9c65e02ebd75fa9b950ecd945f3b54ecdf","sources":[{"modifiedAt":1794562425553,"name":"CNA: VulnCheck","retrievedAt":1794564854965,"url":"https://www.cve.org/CVERecord?id=CVE-2026-128242"},{"modifiedAt":1794565092180,"name":"NVD","retrievedAt":1794572256678,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128242"}],"ssvc":null,"status":"published","title":"actix-http before 3.20.1 and actix-web before 4.18.2 Decompression Bomb DoS via encoding::Decoder","updatedAt":1794572256678}