Description
actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| actix | actix-http | < 3.20.1 | 3.20.1 |
| actix | actix-web | < 4.18.2 | 4.18.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | rust-actix-http | No fix yet | — |
| Ubuntu 26.04 LTS | rust-actix-http | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | actix-http | >= 0.0.0-0, < 3.20.1 | 3.20.1 | RUSTSEC-2026-0448 |
| crates.io | actix-web | >= 0.0.0-0, < 4.18.2 | 4.18.2 | RUSTSEC-2026-0447 |
References
- GitHub Security Advisory (GHSA-qph8-7859-gq2f) vendor-advisory
- https://rustsec.org/advisories/RUSTSEC-2026-0448.html third-party-advisory
- https://github.com/actix/actix-web/commit/41b54d23ea04f66758c15de7e4ab18325cd25280 patch
- https://github.com/actix/actix-web/commit/0d0be61bd757027bfcecbc53df1b7a600f21ecd0 patch
- https://github.com/actix/actix-web/blob/actix-http-v3.20.0/actix-http/src/encoding/decoder.rs#L239-L301 technical-description
- actix-web actix-http-v3.20.1 Release Notes release-notes
- actix-web actix-web-v4.18.2 Release Notes release-notes
- https://github.com/actix/actix-web product
- VulnCheck Advisory: actix-http before 3.20.1 and actix-web before 4.18.2 Decompression Bomb DoS via encoding::Decoder third-party-advisory