RUSTSEC-2026-0455

    Dashboard / Vulnerabilities / RUSTSEC-2026-0455

    RUSTSEC-2026-0455

    Published: 6 Nov 2026Last Modified: 6 Nov 2026

    Summary: Large-window Brotli bodies bypass decompression memory limits

    Details: With the `compress-brotli` feature enabled, the decoder accepts the non-standard large-window Brotli format. A crafted stream can cause its internal buffer to grow to about 1 GiB before the decoded output reaches the configured size limit. An 850-byte request can cause this allocation, and concurrent requests can exhaust process or host memory. Actix Web enables Brotli support by default. Applications that read request bodies through `Bytes`, `String`, `Json`, or `Form` can be affected even when extractor size limits are configured. The allocation occurs before the handler runs, so authentication performed in the handler does not prevent it. Upgrade to actix-http 3.20.3 or later. As a workaround, reject requests with `Content-Encoding: br` at a reverse proxy or in middleware before body extraction, or disable the `compress-brotli` feature throughout the dependency graph.

    References: https://crates.io/crates/actix-http, https://rustsec.org/advisories/RUSTSEC-2026-0455.html, https://github.com/actix/actix-web/commit/61c6a15c1c0e505a5cd6842610a5f1faea432a83

    Affected packages

    Package

    Name: actix-http

    Purl: pkg:cargo/actix-http

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0.0.0-0
    Fixed -3.20.3

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    RUSTSEC-2026-0455 | CVE-DB