CVE-2026-49755

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in wojtekmach Req allows attacker-controlled HTTP servers to exhaust memory in a Req client via decompression-bomb response bodies. Req's default response pipeline includes Req.Steps.decode_body/1 and Req.Steps.decompress_body/1 in lib/req/steps.ex. decode_body/1 dispatches on the server-supplied content-type (or URL extension) and calls :zip.extract(body, [:memory]) for application/zip, :erl_tar.extract({:binary, body}, [:memory]) for application/x-tar, and :erl_tar.extract({:binary, body}, [:memory, :compressed]) for application/gzip / .tgz. Each returns the full decompressed archive contents as a [{name, bytes}] list in memory, with no per-entry or total size cap. decompress_body/1 walks the content-encoding header and chains :zlib/:brotli/:ezstd decoders, so a response advertising content-encoding: gzip, gzip, gzip inflates through multiple layers without bound. Both steps are enabled by default, no caller opt-in is required, and the attacker controls the content-type and content-encoding headers on their own server (or on any host reached via Req's automatic redirect following). A sub-megabyte response can expand to multiple gigabytes on the victim, crashing the BEAM process. This issue affects req: from 0.1.0 before 0.6.1.

• CWE-409

• https://cna.erlef.org/cves/CVE-2026-49755.htmlThird Party Advisory
• https://github.com/wojtekmach/req/commit/84977e5b1a83f26e749d55ad06e3625464af4e8dPatch
• https://github.com/wojtekmach/req/security/advisories/GHSA-655f-mp8p-96gvVendor Advisory, Exploit, Patch
• https://osv.dev/vulnerability/EEF-CVE-2026-49755Third Party Advisory, Patch, Mitigation
• https://github.com/wojtekmach/req/security/advisories/GHSA-655f-mp8p-96gvVendor Advisory, Exploit, Patch

Published

Jun 8, 2026

Last Modified

Aug 18, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49744Kernel software installed and running inside a Guest VM may …7.8
• CVE-2026-49745Kernel software installed and running inside a Guest VM may …7.8
• CVE-2026-49746Software installed and run as a non-privileged user may cond…7.1
• CVE-2026-4975A vulnerability has been found in Tenda AC15 15.03.05.19. Th…8.8
• CVE-2026-49753Inconsistent Interpretation of HTTP Requests ('HTTP Request/…6.3
• CVE-2026-49754Allocation of Resources Without Limits or Throttling vulnera…8.2
• CVE-2026-49756Improper Neutralization of CRLF Sequences ('CRLF Injection')…3.7
• CVE-2026-49757Authentication Bypass by Spoofing vulnerability in team-alem…9.2
• CVE-2026-49759Stack-based Buffer Overflow vulnerability in Erlang OTP erts…8.2
• CVE-2026-4976A vulnerability was found in Totolink LR350 9.3.5u.6369_B202…8.8
• CVE-2026-49760Stack-based Buffer Overflow vulnerability in Erlang OTP (erl…5.5
• CVE-2026-49762Uncontrolled Resource Consumption vulnerability in the Elixi…5.1