Actix web: Compressed request bodies can exhaust memory before extractor limits apply
Affects actix-webSource GCVE Database
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in 4.18.2
Data as of 6 Nov 2026, 15:47 UTC
What to do
Upgrade actix-web to 4.18.2.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.ioactix-webpkg:cargo/actix-webOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade to actix-web version 4.18.2 or later and actix-http 3.20.1 or later to apply the official fix. As a temporary workaround, configure a reverse proxy or middleware to reject compressed request bodies before they reach the body extraction stage.
Description
A vulnerability in actix-web allows compressed request bodies to exhaust memory or CPU resources before size limits are enforced by body extractors. This occurs because the decompression layer does not respect the size limits set by extractors, enabling a small compressed request to expand into a large allocation. This can lead to denial of service in applications that accept compressed request bodies with compression enabled. The issue is fixed in actix-web version 4.18.2 and actix-http 3.20.1 or later. As a workaround, rejecting compressed request bodies at a reverse proxy or middleware before extraction is recommended.