Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Informational severity, published 6 November 2026.
- Which products and versions are affected?
- Actix-Http before 3.20.1; Actix-Web before 4.18.2; actix-http (crates.io) SEMVER:introduced=0.0.0-0,fixed=3.20.1.
- Is there a fix for This vulnerability?
- Yes. actix-http (crates.io): upgrade to 3.20.1 or later. Until then: Configure Decoder::limit() when using the decoder directly to enforce decompression size constraints before expansion occurs. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is This vulnerability attacked?
- It is attacked over the network.
- Am I affected?
- Check whether you run Actix-Http, Actix-Web or actix-http (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- actix-http (crates.io): upgrade to 3.20.1 or later
cargo update -p actix-http
Configure Decoder::limit() when using the decoder directly to enforce decompression size constraints before expansion occurs.
Technical details
The encoding::Decoder stream in actix-http expands compressed input into an output buffer before enforcing caller-imposed body size limits. An attacker controlling compressed requests or responses can trigger unbounded decompression, exhausting memory and CPU. The vulnerability affects applications using gzip, deflate, Brotli, or Zstandard decompression with corresponding features enabled.
Affected products
- Actix actix-http before 3.20.1
- Actix actix-web before 4.18.2
Identifiers
- GHSA-qph8-7859-gq2f
- RUSTSEC-2026-0447
- RUSTSEC-2026-0448
Timeline
- 2026-11-06: disclosed