A vulnerability in actix-http's encoding::Decoder allows unbounded decompression of compressed input streams, which can lead to excessive memory and CPU consumption. This can cause denial of service when processing untrusted gzip, deflate, Brotli, or Zstandard compressed bodies. The issue affects versions prior to 3.20.1. Fixed in actix-http 3.20.1 and actix-web 4.18.2, where limits on decompression are enforced.