Threats tagged 'ghsa-gxj9-vqfq-hp64'

An unbounded decompression vulnerability exists in actix-http before 3.20.1 and actix-web before 4.18.2 in the encoding::Decoder component. This flaw allows remote attackers to exhaust server memory and CPU resources by sending small, highly compressed request bodies using gzip, deflate, Brotli, or zstd compression. The vulnerability affects various extractors such as Json, Form, Bytes, or String, as well as awc clients, potentially causing denial of service.