RUSTSEC-2026-0455 (GHSA-7P9W-P5QM-5GC5)

Vulnerability from osv_rustsec – Published: 2026-11-06 12:00 – Updated: 2026-11-06 15:34 – Source website
VLAI
Summary
Large-window Brotli bodies bypass decompression memory limits
Details

With the compress-brotli feature enabled, the decoder accepts the non-standard large-window Brotli format. A crafted stream can cause its internal buffer to grow to about 1 GiB before the decoded output reaches the configured size limit. An 850-byte request can cause this allocation, and concurrent requests can exhaust process or host memory.

Actix Web enables Brotli support by default. Applications that read request bodies through Bytes, String, Json, or Form can be affected even when extractor size limits are configured. The allocation occurs before the handler runs, so authentication performed in the handler does not prevent it.

Upgrade to actix-http 3.20.3 or later. As a workaround, reject requests with Content-Encoding: br at a reverse proxy or in middleware before body extraction, or disable the compress-brotli feature throughout the dependency graph.

References
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "denial-of-service"
        ],
        "cvss": null,
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "actix-http",
        "purl": "pkg:cargo/actix-http"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "3.20.3"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "GHSA-7p9w-p5qm-5gc5"
  ],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "With the `compress-brotli` feature enabled, the decoder accepts the non-standard\nlarge-window Brotli format. A crafted stream can cause its internal buffer to\ngrow to about 1 GiB before the decoded output reaches the configured size limit.\nAn 850-byte request can cause this allocation, and concurrent requests can\nexhaust process or host memory.\n\nActix Web enables Brotli support by default. Applications that read request\nbodies through `Bytes`, `String`, `Json`, or `Form` can be affected even when\nextractor size limits are configured. The allocation occurs before the handler\nruns, so authentication performed in the handler does not prevent it.\n\nUpgrade to actix-http 3.20.3 or later. As a workaround, reject requests with\n`Content-Encoding: br` at a reverse proxy or in middleware before body\nextraction, or disable the `compress-brotli` feature throughout the dependency\ngraph.",
  "id": "RUSTSEC-2026-0455",
  "modified": "2026-11-06T15:34:32Z",
  "published": "2026-11-06T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/actix-http"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0455.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/actix/actix-web/commit/61c6a15c1c0e505a5cd6842610a5f1faea432a83"
    }
  ],
  "related": [],
  "severity": [],
  "summary": "Large-window Brotli bodies bypass decompression memory limits"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.