Vulnerability Details CVE-2026-49755
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in wojtekmach Req allows attacker-controlled HTTP servers to exhaust memory in a Req client via decompression-bomb response bodies.
Req's default response pipeline includes Req.Steps.decode_body/1 and Req.Steps.decompress_body/1 in lib/req/steps.ex. decode_body/1 dispatches on the server-supplied content-type (or URL extension) and calls :zip.extract(body, [:memory]) for application/zip, :erl_tar.extract({:binary, body}, [:memory]) for application/x-tar, and :erl_tar.extract({:binary, body}, [:memory, :compressed]) for application/gzip / .tgz. Each returns the full decompressed archive contents as a [{name, bytes}] list in memory, with no per-entry or total size cap. decompress_body/1 walks the content-encoding header and chains :zlib/:brotli/:ezstd decoders, so a response advertising content-encoding: gzip, gzip, gzip inflates through multiple layers without bound.
Both steps are enabled by default, no caller opt-in is required, and the attacker controls the content-type and content-encoding headers on their own server (or on any host reached via Req's automatic redirect following). A sub-megabyte response can expand to multiple gigabytes on the victim, crashing the BEAM process.
This issue affects req: from 0.1.0 before 0.6.1.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 36.5%
CVSS Severity
CVSS v3 Score 7.5
References
- https://cna.erlef.org/cves/CVE-2026-49755.html
- https://github.com/wojtekmach/req/commit/84977e5b1a83f26e749d55ad06e3625464af4e8d
- https://github.com/wojtekmach/req/security/advisories/GHSA-655f-mp8p-96gv
- https://osv.dev/vulnerability/EEF-CVE-2026-49755
- https://github.com/wojtekmach/req/security/advisories/GHSA-655f-mp8p-96gv
Products affected by CVE-2026-49755
-
cpe:2.3:a:wojtekmach:req:0.1.0
-
cpe:2.3:a:wojtekmach:req:0.1.1
-
cpe:2.3:a:wojtekmach:req:0.1.2
-
cpe:2.3:a:wojtekmach:req:0.2.0
-
cpe:2.3:a:wojtekmach:req:0.2.1
-
cpe:2.3:a:wojtekmach:req:0.2.2
-
cpe:2.3:a:wojtekmach:req:0.3.0
-
cpe:2.3:a:wojtekmach:req:0.3.1
-
cpe:2.3:a:wojtekmach:req:0.3.10
-
cpe:2.3:a:wojtekmach:req:0.3.11
-
cpe:2.3:a:wojtekmach:req:0.3.12
-
cpe:2.3:a:wojtekmach:req:0.3.2
-
cpe:2.3:a:wojtekmach:req:0.3.3
-
cpe:2.3:a:wojtekmach:req:0.3.4
-
cpe:2.3:a:wojtekmach:req:0.3.5
-
cpe:2.3:a:wojtekmach:req:0.3.6
-
cpe:2.3:a:wojtekmach:req:0.3.7
-
cpe:2.3:a:wojtekmach:req:0.3.8
-
cpe:2.3:a:wojtekmach:req:0.3.9
-
cpe:2.3:a:wojtekmach:req:0.4.0
-
cpe:2.3:a:wojtekmach:req:0.4.1
-
cpe:2.3:a:wojtekmach:req:0.4.10
-
cpe:2.3:a:wojtekmach:req:0.4.11
-
cpe:2.3:a:wojtekmach:req:0.4.12
-
cpe:2.3:a:wojtekmach:req:0.4.13
-
cpe:2.3:a:wojtekmach:req:0.4.14
-
cpe:2.3:a:wojtekmach:req:0.4.2
-
cpe:2.3:a:wojtekmach:req:0.4.3
-
cpe:2.3:a:wojtekmach:req:0.4.4
-
cpe:2.3:a:wojtekmach:req:0.4.5
-
cpe:2.3:a:wojtekmach:req:0.4.6
-
cpe:2.3:a:wojtekmach:req:0.4.7
-
cpe:2.3:a:wojtekmach:req:0.4.8
-
cpe:2.3:a:wojtekmach:req:0.4.9
-
cpe:2.3:a:wojtekmach:req:0.5.0
-
cpe:2.3:a:wojtekmach:req:0.5.1
-
cpe:2.3:a:wojtekmach:req:0.5.10
-
cpe:2.3:a:wojtekmach:req:0.5.11
-
cpe:2.3:a:wojtekmach:req:0.5.12
-
cpe:2.3:a:wojtekmach:req:0.5.13
-
cpe:2.3:a:wojtekmach:req:0.5.14
-
cpe:2.3:a:wojtekmach:req:0.5.15
-
cpe:2.3:a:wojtekmach:req:0.5.16
-
cpe:2.3:a:wojtekmach:req:0.5.17
-
cpe:2.3:a:wojtekmach:req:0.5.18
-
cpe:2.3:a:wojtekmach:req:0.5.2
-
cpe:2.3:a:wojtekmach:req:0.5.3
-
cpe:2.3:a:wojtekmach:req:0.5.4
-
cpe:2.3:a:wojtekmach:req:0.5.5
-
cpe:2.3:a:wojtekmach:req:0.5.6
-
cpe:2.3:a:wojtekmach:req:0.5.7
-
cpe:2.3:a:wojtekmach:req:0.5.8
-
cpe:2.3:a:wojtekmach:req:0.5.9
-
cpe:2.3:a:wojtekmach:req:0.6.0