A vulnerability in actix-http with the compress-brotli feature enabled allows crafted Brotli-encoded HTTP request bodies to bypass decompression memory limits. This can cause the internal buffer to grow to about 1 GiB before the output size limit is reached, potentially exhausting process or host memory with concurrent requests. The issue affects applications that read request bodies via Bytes, String, Json, or Form, even if extractor size limits are configured. The vulnerability is fixed in actix-http version 3.20.3.