A vulnerability in actix-web allows compressed request bodies to exhaust memory or CPU resources before size limits are enforced by body extractors. This occurs because the decompression layer does not respect the size limits set by extractors, enabling a small compressed request to expand into a large allocation. This can lead to denial of service in applications that accept compressed request bodies with compression enabled. The issue is fixed in actix-web version 4.18.2 and actix-http 3.20.1 or later. As a workaround, rejecting compressed request bodies at a reverse proxy or middleware before extraction is recommended.