The vulnerability arises from Req's default response pipeline steps decode_body/1 and decompress_body/1, which handle decompression of various archive formats and chained content-encoding headers respectively. These steps use Erlang functions :zip.extract and :erl_tar.extract without enforcing per-entry or total decompressed size limits. An attacker controlling the content-type and content-encoding headers can craft responses that decompress to extremely large sizes, causing memory exhaustion and crashing the Req client process. This affects Req versions starting at 0.1.0 up to but not including 0.6.1.

An attacker can cause a denial of service by sending a maliciously crafted HTTP response that decompresses into a very large payload, exhausting memory on the victim's system and crashing the BEAM process running the Req client. This can disrupt applications relying on Req for HTTP communication, potentially leading to service outages or degraded functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is indicated in the provided data. Until a patch is available, users should consider disabling automatic decompression steps or validating response sizes before decompression if possible, or avoid using Req versions prior to 0.6.1 with untrusted servers.