CVE-2026-128242
Last modified
CVE-2026-128242 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service..
Description
actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| actix | actix-http | < 3.20.1 |
| actix | actix-web | < 4.18.2 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-128242?
How severe is CVE-2026-128242?
How do I fix CVE-2026-128242?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-12823A security flaw has been discovered in Browserbase Skills up…3.3
- CVE-2026-128237Scapy before 2.8.0 contains a denial of service vulnerabilit…5.3
- CVE-2026-128238Scapy before 2.8.0 contains an uncontrolled recursion vulner…5.3
- CVE-2026-128239GPAC through 26.07.0 contains a NULL pointer dereference vul…5.5
- CVE-2026-128240GPAC through 26.07.0 contains a use-after-free vulnerability…5.5
- CVE-2026-128241The xmlwf tool in libexpat through 2.10.0 contains a symlink…4.4
- CVE-2026-1283A Heap-based Buffer Overflow vulnerability affecting the EPR…7.8
- CVE-2026-128321Tight JPEG decoding in TightVNC and UltraVNC viewers contain…
- CVE-2026-128328Dokploy 0.28.0 before 0.31.1 contains a path traversal vulne…5
- CVE-2026-128329Dokploy 0.28.0 before 0.31.1 contains a path traversal vulne…7.7
- CVE-2026-128330Miniflux before 2.3.5 contains an insufficient session expir…4.2
- CVE-2026-128331Miniflux before 2.3.5 contains an unverified password change…5.3
Are you affected by CVE-2026-128242?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST