Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in wojtekmach Req allows attacker-controlled HTTP servers to exhaust memory in a Req client via decompression-bomb respo…
High CVSS 7.5
Summary
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in wojtekmach Req allows attacker-controlled HTTP servers to exhaust memory in a Req client via decompression-bomb response bodies. Req's default response pipeline includes Req.Steps.decode_body/1 and Req.Steps.decompress_body/1 in lib/req/steps.ex. decode_body/1 dispatches on the server-supplied content-type (or URL extension) and calls :zip.extract(body, [:memory]) for application/zip, :erl_tar.extract({:binary, b…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://cna.erlef.org/cves/CVE-2026-49755.html Third Party Advisory
- https://github.com/wojtekmach/req/commit/84977e5b1a83f26e749d55ad06e3625464af4e8d Patch
- https://github.com/wojtekmach/req/security/advisories/GHSA-655f-mp8p-96gv Vendor Advisory
- https://osv.dev/vulnerability/EEF-CVE-2026-49755 Third Party Advisory
- https://github.com/wojtekmach/req/security/advisories/GHSA-655f-mp8p-96gv Vendor Advisory
Timeline
- nvd_ingest NVD