Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Informational severity, published 6 November 2026.
- Which products and versions are affected?
- Actix-Http before 3.20.3; actix-http (crates.io) SEMVER:introduced=0.0.0-0,fixed=3.20.3.
- Is there a fix for This vulnerability?
- Yes. actix-http (crates.io): upgrade to 3.20.3 or later. Until then: Reject requests with Content-Encoding: br at a reverse proxy or in middleware before body extraction, or disable the compress-brotli feature throughout the dependency graph. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is This vulnerability attacked?
- It is attacked over the network.
- Am I affected?
- Check whether you run Actix-Http or actix-http (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- actix-http (crates.io): upgrade to 3.20.3 or later
cargo update -p actix-http
Reject requests with Content-Encoding: br at a reverse proxy or in middleware before body extraction, or disable the compress-brotli feature throughout the dependency graph.
Technical details
The vulnerability exists in actix-http's Brotli decompression handler when the compress-brotli feature is enabled. The decoder accepts the non-standard large-window Brotli format, allowing a crafted stream to grow the internal buffer to ~1 GiB before the size limit check is applied. The memory allocation occurs during body extraction before the application handler executes, bypassing any authentication or authorization checks in handler code.
Affected products
- actix actix-http before 3.20.3
Identifiers
- GHSA-7p9w-p5qm-5gc5
- RUSTSEC-2026-0455
Timeline
- 2026-11-06: disclosed