# actix-http memory exhaustion via large-window Brotli

Source: https://junglewise.ai/threats/rustsec-2026-0455-large-window-brotli-bodies-bypass-decompression-8b64dc69  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-07  
License: CC BY 4.0 with a link back

Severity: info · Published 2026-11-06

actix-http is a web framework library used to handle HTTP requests in Rust applications. When Brotli compression support is enabled (the default), an attacker can send a specially crafted 850-byte request that causes the application to allocate up to 1 GiB of memory before processing completes, potentially exhausting system memory and crashing the service. Multiple concurrent requests can amplify this effect to take down an entire host.

Technologies: [Actix-Http](https://junglewise.ai/threats/technologies/actix-actix-http), [actix-http (crates.io)](https://junglewise.ai/threats/technologies/actix-http). Vendors: [Actix](https://junglewise.ai/threats/vendors/actix), [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 6 November 2026.

**Which products and versions are affected?** Actix-Http before 3.20.3; actix-http (crates.io) SEMVER:introduced=0.0.0-0,fixed=3.20.3.

**Is there a fix for This vulnerability?** Yes. actix-http (crates.io): upgrade to 3.20.3 or later. Until then: Reject requests with Content-Encoding: br at a reverse proxy or in middleware before body extraction, or disable the compress-brotli feature throughout the dependency graph. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run Actix-Http or actix-http (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- actix-http (crates.io): upgrade to 3.20.3 or later

  ```sh
  cargo update -p actix-http
  ```


Reject requests with Content-Encoding: br at a reverse proxy or in middleware before body extraction, or disable the compress-brotli feature throughout the dependency graph.

## Technical details

The vulnerability exists in actix-http's Brotli decompression handler when the compress-brotli feature is enabled. The decoder accepts the non-standard large-window Brotli format, allowing a crafted stream to grow the internal buffer to ~1 GiB before the size limit check is applied. The memory allocation occurs during body extraction before the application handler executes, bypassing any authentication or authorization checks in handler code.

## Affected products

- actix actix-http before 3.20.3

## Identifiers

- GHSA-7p9w-p5qm-5gc5
- RUSTSEC-2026-0455

## Timeline

- 2026-11-06: disclosed

## References

- [https://crates.io/crates/actix-http](https://crates.io/crates/actix-http)
- [https://rustsec.org/advisories/RUSTSEC-2026-0455.html](https://rustsec.org/advisories/RUSTSEC-2026-0455.html)

## Related threats

- [actix-http request smuggling through malformed chunked trailers](https://junglewise.ai/threats/rustsec-2026-0446-request-smuggling-through-malformed-chunked-request-5ce6bfaf)
- [actix-web denial of service via compressed request bodies](https://junglewise.ai/threats/rustsec-2026-0447-compressed-request-bodies-can-exhaust-memory-before-b7c4ea38)
- [actix-http unbounded decompression denial of service](https://junglewise.ai/threats/rustsec-2026-0448-unbounded-decompression-can-exhaust-memory-and-cpu-f56d9644)
- [actix-http has HTTP/1.1 CL.TE Request Smuggling](https://junglewise.ai/threats/cve-2026-73051-actix-http-has-http-1-1-cl-te-request-smuggling)
- [RUSTSEC-2021-0081 - Potential request smuggling capabilities due to lack of input validation](https://junglewise.ai/threats/cve-2021-38512-http-request-smuggling-in-actix-http)