Executive brief
Req, a popular HTTP client for Elixir, is vulnerable to 'decompression bombs' that can crash an application. By default, the library automatically decompresses files received from a server without checking their final size, allowing a small malicious file to expand and consume all available system memory. This can lead to a complete service outage for any application that uses Req to fetch data from external or untrusted sources.
Technical details
Req is vulnerable to a data amplification attack (CWE-409) within its default response pipeline. The `Req.Steps.decode_body/1` and `Req.Steps.decompress_body/1` steps automatically process compressed payloads (e.g., ZIP, TAR, GZIP) based on attacker-controlled `content-type` or `content-encoding` headers. Because the library materializes the entire decompressed payload in RAM using Erlang's `:zip` or `:erl_tar` libraries without enforcing a byte cap or per-entry size limit, a small 'decompression bomb' can trigger memory exhaustion. This can be exploited by any remote server the client connects to, including via automatic redirect following. The vulnerability is fixed in version 0.6.1.
Affected products
- wojtekmach req >= 0.1.0, < 0.6.1
Timeline
- 2026-06-08: disclosed
- 2026-06-08: patched: Version 0.6.1 released
- 2026-07-29: advisory