https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 15 Nov 2026 14:05:42 +0000 https://db.gcve.eu/vuln/ghsa-gxj9-vqfq-hp64 <p>actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.</p> <p>actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.</p> https://db.gcve.eu/vuln/ghsa-gxj9-vqfq-hp64 https://db.gcve.eu/vuln/msrc_cve-2026-128242 msrc_CVE-2026-128242 https://db.gcve.eu/vuln/msrc_cve-2026-128242 https://db.gcve.eu/vuln/rustsec-2026-0448 <p><strong>Affected:</strong> crates.io: actix-http</p> <p>The `encoding::Decoder` stream can expand compressed input into a large output buffer before a caller can enforce its body size limit. An attacker who controls a compressed request or response can cause excessive memory allocation and CPU use, resulting in denial of service.</p> <p>This affects applications that decode untrusted gzip, deflate, Brotli, or Zstandard bodies with the corresponding compression feature enabled.</p> <p>Upgrade to actix-http 3.20.1 or later and configure `Decoder::limit()` when using the decoder directly. Actix Web users must also upgrade to actix-web 4.18.2 or later so that extractors pass their limits to the decoder.</p> <p><strong>Affected:</strong> crates.io: actix-http</p> <p>The `encoding::Decoder` stream can expand compressed input into a large output buffer before a caller can enforce its body size limit. An attacker who controls a compressed request or response can cause excessive memory allocation and CPU use, resulting in denial of service.</p> <p>This affects applications that decode untrusted gzip, deflate, Brotli, or Zstandard bodies with the corresponding compression feature enabled.</p> <p>Upgrade to actix-http 3.20.1 or later and configure `Decoder::limit()` when using the decoder directly. Actix Web users must also upgrade to actix-web 4.18.2 or later so that extractors pass their limits to the decoder.</p> https://db.gcve.eu/vuln/rustsec-2026-0448 https://db.gcve.eu/vuln/ubuntu-cve-2026-128242 <p><strong>Affected:</strong> Ubuntu:26.10: rust-actix-http, Ubuntu:26.04:LTS: rust-actix-http</p> <p>actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.</p> <p><strong>Affected:</strong> Ubuntu:26.10: rust-actix-http, Ubuntu:26.04:LTS: rust-actix-http</p> <p>actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.</p> https://db.gcve.eu/vuln/ubuntu-cve-2026-128242