Actix http: Unbounded decompression can exhaust memory and CPU resources
Affects actix-httpSource GCVE Database
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in 3.20.1
Data as of 6 Nov 2026, 15:40 UTC
What to do
Upgrade actix-http to 3.20.1.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.ioactix-httppkg:cargo/actix-httpOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade actix-http to version 3.20.1 or later. When using the decoder directly, configure Decoder::limit() to enforce decompression size limits. Actix Web users must upgrade to actix-web 4.18.2 or later to ensure extractors pass their limits to the decoder. These updates fix the vulnerability by enforcing decompression limits and preventing unbounded resource consumption.
Description
A vulnerability in actix-http's encoding::Decoder allows unbounded decompression of compressed input streams, which can lead to excessive memory and CPU consumption. This can cause denial of service when processing untrusted gzip, deflate, Brotli, or Zstandard compressed bodies. The issue affects versions prior to 3.20.1. Fixed in actix-http 3.20.1 and actix-web 4.18.2, where limits on decompression are enforced.