CVE-2026-49755

Decompression bomb DoS in Req via auto-decoded archive and compressed response bodies

No known exploitation. EPSS puts it in the 53rd percentile. Fixed in 0.6.1.

CVSS 3.17.5High EPSS percentile53rd0.7% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix0.6.1Upgrade to this build

Published 2026-06-08Updated 2026-08-18Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Wojtekmach ReqAffected: ≥ 0.1.0, < 0.6.1Upgrade to: 0.6.1Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check your Elixir project’s dependency lock file to see whether it uses Req before 0.6.1.
Update Req to version 0.6.1 or later and deploy the updated application.
If updating is delayed, disable automatic body decoding for requests to attacker-influenced URLs using decode_body: false; use raw: true to also bypass response decompression.
Test any integrations that download archives or compressed files after deployment.

mix deps.update req

Vendor advisory Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in wojtekmach Req allows attacker-controlled HTTP servers to exhaust memory in a Req client via decompression-bomb response bodies. Req's default response pipeline includes Req.Steps.decode_body/1 and Req.Steps.decompress_body/1 in lib/req/steps.ex. decode_body/1 dispatches on the server-supplied content-type (or URL extension) and calls :zip.extract(body, [:memory]) for application/zip, :erl_tar.extract({:binary, body}, [:memory]) for application/x-tar, and :erl_tar.extract({:binary, body}, [:memory, :compressed]) for application/gzip / .tgz. Each returns the full decompressed archive contents as a [{name, bytes}] list in memory, with no per-entry or total size cap. decompress_body/1 walks the content-encoding header and chains :zlib/:brotli/:ezstd decoders, so a response advertising content-encoding: gzip, gzip, gzip inflates through multiple layers without bound. Both steps are enabled by default, no caller opt-in is required, and the attacker controls the content-type and content-encoding headers on their own server (or on any host reached via Req's automatic redirect following). A sub-megabyte response can expand to multiple gigabytes on the victim, crashing the BEAM process. This issue affects req: from 0.1.0 before 0.6.1.

In plain language

Written by AI from the record

Req versions 0.1.0 through before 0.6.1 can be crashed by a malicious server response, so businesses using Req should update promptly.

CWE-409 denial of service in Req’s default archive and content-encoding decoding pipeline allows attacker-controlled responses to expand in memory without size limits.

What is it

This flaw can let a website send a very small compressed file that expands into an enormous amount of data inside your application. It is like accepting a tiny delivery box that opens into a warehouse full of boxes, exhausting the space available and stopping the service.

Who is affected

This matters to you if your Elixir application uses Req to fetch files, web pages, or service responses. Risk is greatest where Req can be directed to URLs influenced by customers, users, redirects, or external integrations.

How urgent is it

An attacker who can cause your application to fetch a response from a server they control can use it to consume memory and stop the affected application. There is no recorded public exploit code and it is not listed in CISA’s known-exploited catalog, so this is an amber priority: remediate in a planned near-term release.

What to do — in detail

Confirm the resolved Req version in mix.lock and identify request flows that can reach attacker-controlled URLs, including redirects and file-download features.

Upgrade the :req dependency to 0.6.1 or later, run mix deps.update req, then rebuild and deploy. Review dependency constraints if they prevent resolution to 0.6.1; no breaking-change note is provided in the findings.

Until deployment, pass decode_body: false to Req.new/1 or Req.get!/1 for attacker-influenced URLs. Use raw: true as well when the content-encoding decompression pipeline must be skipped. Monitor application memory growth, BEAM process crashes, and unusually compressed or archive-like HTTP responses. No CISA KEV remediation due date applies.

Technical context

CVSS 3.1 is 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The issue is CWE-409: unbounded expansion of compressed response bodies and archives during Req’s default decoding path. An attacker-controlled server can supply content type and content encoding headers, including chained encodings, causing in-memory decompression or archive extraction. EPSS is 0.6% at the 47th percentile and flat. It is not in CISA KEV, and no public exploit code is on record; press attention is rising.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS53rd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.7% chance of exploitation activity in the next 30 days, which ranks it in the 53rd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

9 events over 71 days, from the signal feeds we watch.

2026-08-18Patch availableworkaround available, record updated
2026-07-23Workaround availablerecord updated
2026-06-09Workaround availablerecord updated
2026-06-08Publishedweakness classified

Affected products

wojtekmachindividual-dev
- reqOn-premOSS Libraries

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality NoneNo confidentiality impact
Integrity NoneNo integrity impact
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

CWE-409No name in the record

Sources

References in the record

And 1 more reference. See all after sign-in

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Req, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account