Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-49755— Decompression bomb DoS in Req via auto-decoded archive and compressed response bodies

Quick assessment

Affected
wojtekmach req
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

req是roc个人开发者的一个使用 Black Magic 的简单 Go HTTP 客户端。 Req 0.1.0版本至0.6.1之前版本存在安全漏洞，该漏洞源于对高度压缩数据处理不当，可能导致攻击者控制的HTTP服务器通过解压炸弹响应体耗尽Req客户端内存。

AI Predicted 7.5 Difficulty: Easy EPSS 0.70% · P52

Affected Version Matrix 2

VendorProduct Version RangeStatus
wojtekmach req 0.1.0< 0.6.1 affected
e37753741cbdc725e6aba3d977b380163bfc0ecb< 84977e5b1a83f26e749d55ad06e3625464af4e8d affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-49755

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Decompression bomb DoS in Req via auto-decoded archive and compressed response bodies
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in wojtekmach Req allows attacker-controlled HTTP servers to exhaust memory in a Req client via decompression-bomb response bodies. Req's default response pipeline includes Req.Steps.decode_body/1 and Req.Steps.decompress_body/1 in lib/req/steps.ex. decode_body/1 dispatches on the server-supplied content-type (or URL extension) and calls :zip.extract(body, [:memory]) for application/zip, :erl_tar.extract({:binary, body}, [:memory]) for application/x-tar, and :erl_tar.extract({:binary, body}, [:memory, :compressed]) for application/gzip / .tgz. Each returns the full decompressed archive contents as a [{name, bytes}] list in memory, with no per-entry or total size cap. decompress_body/1 walks the content-encoding header and chains :zlib/:brotli/:ezstd decoders, so a response advertising content-encoding: gzip, gzip, gzip inflates through multiple layers without bound. Both steps are enabled by default, no caller opt-in is required, and the attacker controls the content-type and content-encoding headers on their own server (or on any host reached via Req's automatic redirect following). A sub-megabyte response can expand to multiple gigabytes on the victim, crashing the BEAM process. This issue affects req: from 0.1.0 before 0.6.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对高度压缩数据的处理不恰当(数据放大攻击)
Source: CVE Program / CVE List V5
Vulnerability Title
req 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
req是roc个人开发者的一个使用 Black Magic 的简单 Go HTTP 客户端。 Req 0.1.0版本至0.6.1之前版本存在安全漏洞，该漏洞源于对高度压缩数据处理不当，可能导致攻击者控制的HTTP服务器通过解压炸弹响应体耗尽Req客户端内存。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
wojtekmach req 0.1.0 ~ 0.6.1 cpe:2.3:a:wojtekmach:req:*:*:*:*:*:*:*:*
wojtekmach req e37753741cbdc725e6aba3d977b380163bfc0ecb ~ 84977e5b1a83f26e749d55ad06e3625464af4e8d cpe:2.3:a:wojtekmach:req:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-49755

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-49755

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-49755 (1)

Vendor Advisories for CVE-2026-49755 (3)

IV. Related Vulnerabilities

Same product: req
Same vendor: wojtekmach
Same weakness: CWE-409

V. Comments for CVE-2026-49755

No comments yet

Leave a comment