{"id":"RUSTSEC-2026-0448","summary":"Unbounded decompression can exhaust memory and CPU resources","details":"The `encoding::Decoder` stream can expand compressed input into a large output\nbuffer before a caller can enforce its body size limit. An attacker who controls\na compressed request or response can cause excessive memory allocation and CPU\nuse, resulting in denial of service.\n\nThis affects applications that decode untrusted gzip, deflate, Brotli, or Zstandard\nbodies with the corresponding compression feature enabled.\n\nUpgrade to actix-http 3.20.1 or later and configure `Decoder::limit()` when using\nthe decoder directly. Actix Web users must also upgrade to actix-web 4.18.2 or\nlater so that extractors pass their limits to the decoder.","aliases":["GHSA-qph8-7859-gq2f","RUSTSEC-2026-0447"],"modified":"2026-11-06T14:56:05.870288153Z","published":"2026-11-06T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/actix-http"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0448.html"},{"type":"WEB","url":"https://github.com/actix/actix-web/commit/41b54d23ea04f66758c15de7e4ab18325cd25280"}],"affected":[{"package":{"name":"actix-http","ecosystem":"crates.io","purl":"pkg:cargo/actix-http"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"3.20.1"}]}],"ecosystem_specific":{"affects":{"os":[],"functions":[],"arch":[]},"affected_functions":null},"database_specific":{"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0448.json","categories":["denial-of-service"],"cvss":null}}],"schema_version":"1.9.2"}