Actix http: Large-window Brotli bodies bypass decompression memory limits
Affects actix-httpSource GCVE Database
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in 3.20.3
Data as of 6 Nov 2026, 16:48 UTC
What to do
Upgrade actix-http to 3.20.3.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.ioactix-httppkg:cargo/actix-httpOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade to actix-http version 3.20.3 or later, where this issue is fixed. As a temporary workaround, reject requests with the Content-Encoding: br header at a reverse proxy or in middleware before body extraction, or disable the compress-brotli feature throughout the dependency graph.
Description
A vulnerability in actix-http with the compress-brotli feature enabled allows crafted Brotli-encoded HTTP request bodies to bypass decompression memory limits. This can cause the internal buffer to grow to about 1 GiB before the output size limit is reached, potentially exhausting process or host memory with concurrent requests. The issue affects applications that read request bodies via Bytes, String, Json, or Form, even if extractor size limits are configured. The vulnerability is fixed in actix-http version 3.20.3.