Skip to content
OpenAdvisories

Package · Hex

req

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 8.2
    CVE-2026-49755

    Decompression bomb DoS in Req via auto-decoded archive and compressed response bodies

    Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in wojtekmach Req allows attacker-controlled HTTP servers to exhaust memory in a Req client via decompression-bomb response bodies. Req's default response pipeline includes Req.Ste…

    wojtekmach req req Hex
  • Low 2.1
    CVE-2026-49756

    Multipart form-data header injection in Req via unescaped name/filename/content_type

    Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in wojtekmach Req allows multipart parameter smuggling via attacker-influenced part metadata. Req.Utils.encode_form_part/2 in lib/req/utils.ex builds the per-part headers by interpolat…

    wojtekmach req req Hex