Skip to content
Threat Feed
Subscribe

Product

Req (>= 0.1.0, < 0.6.1)

1 brief RSS
medium advisory

Req Library Unbounded Archive/Compression Extraction Denial-of-Service

The Elixir library 'Req' (versions >= 0.1.0, < 0.6.1) is susceptible to a denial-of-service vulnerability (CVE-2026-49755) caused by unbounded archive and compression extraction, which an attacker can leverage by providing a malicious HTTP response with a crafted 'content-type' or 'content-encoding' header, leading to memory exhaustion and application crashes.

Req denial-of-service elixir vulnerability memory-exhaustion
1t 1c