{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/req--0.1.0--0.6.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-49755"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Req (\u003e= 0.1.0, \u003c 0.6.1)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","elixir","vulnerability","memory-exhaustion"],"_cs_type":"advisory","_cs_vendors":["Erlang"],"content_html":"\u003cp\u003eAn attacker can exploit a high-severity denial-of-service vulnerability (CVE-2026-49755) in the Elixir 'Req' library, specifically versions 0.1.0 through 0.6.0. This vulnerability, dubbed a \u0026quot;decompression bomb,\u0026quot; arises from Req's default pipeline, which automatically decodes archive and compressed HTTP response bodies without enforcing size limits. By controlling an HTTP endpoint or redirecting a victim's Req client, an attacker can return a small, specially crafted archive or compressed payload. Req's internal processing will then expand this payload into many gigabytes of memory within the Erlang BEAM virtual machine, leading to memory exhaustion and a denial-of-service crash of the Elixir application. This affects applications that fetch untrusted URLs using \u003ccode\u003eReq.get!/1\u003c/code\u003e, such as webhook senders, link previews, OAuth/OIDC discovery clients, and package mirrors.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker establishes control over an HTTP server or can redirect a victim's Req client to a malicious HTTP endpoint.\u003c/li\u003e\n\u003cli\u003eThe attacker configures the malicious server to respond to incoming HTTP requests with an HTTP 200 status code.\u003c/li\u003e\n\u003cli\u003eThe response includes a \u003ccode\u003eContent-Type\u003c/code\u003e header specifying an archive format (e.g., \u003ccode\u003eapplication/zip\u003c/code\u003e) or a \u003ccode\u003eContent-Encoding\u003c/code\u003e header for compression.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a small HTTP response body containing a \u0026quot;decompression bomb\u0026quot; - a highly compressed archive with a single, very large entry (e.g., hundreds of megabytes of zero bytes).\u003c/li\u003e\n\u003cli\u003eA victim Elixir application, using \u003ccode\u003eReq.get!/1\u003c/code\u003e with its default pipeline, sends an HTTP GET request to the attacker-controlled URL.\u003c/li\u003e\n\u003cli\u003eReq's \u003ccode\u003eReq.Steps.decode_body/1\u003c/code\u003e or \u003ccode\u003eReq.Steps.decompress_body/1\u003c/code\u003e steps are invoked automatically based on the \u003ccode\u003eContent-Type\u003c/code\u003e or \u003ccode\u003eContent-Encoding\u003c/code\u003e headers.\u003c/li\u003e\n\u003cli\u003eReq utilizes Erlang's \u003ccode\u003e:zip.extract/2\u003c/code\u003e or \u003ccode\u003e:erl_tar.extract/2\u003c/code\u003e with the \u003ccode\u003e:memory\u003c/code\u003e option, or chains multiple \u003ccode\u003e:zlib\u003c/code\u003e decoders, without applying any size limits.\u003c/li\u003e\n\u003cli\u003eThe small compressed payload is fully decompressed or expanded into a large in-memory structure, leading to memory exhaustion of the Erlang BEAM VM and a denial-of-service crash for the victim application.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability results in a memory-exhaustion denial of service against any Elixir application that uses the Req library with its default step pipeline to fetch URLs influenced by an untrusted party. This includes applications functioning as webhook senders, link preview generators, OAuth/OIDC discovery clients, package mirrors, or image proxies. No authentication is required for exploitation; a single malicious HTTP response can crash the Erlang BEAM virtual machine, potentially taking down unrelated workloads sharing the same VM.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch affected Req versions by upgrading to Req 0.6.1 or later to mitigate CVE-2026-49755.\u003c/li\u003e\n\u003cli\u003eImplement explicit size limits or disable automatic archive/compression decoding when using \u003ccode\u003eReq.get!\u003c/code\u003e to fetch content from untrusted sources, particularly for functionalities like webhook processing or link previews.\u003c/li\u003e\n\u003cli\u003eMonitor Elixir application logs for out-of-memory errors or sudden increases in memory usage that could indicate an attempted denial-of-service attack.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-29T15:25:00Z","date_published":"2026-07-29T15:25:00Z","id":"https://feed.craftedsignal.io/briefs/2026-07-req-decompression-bomb/","summary":"The Elixir library 'Req' (versions \u003e= 0.1.0, \u003c 0.6.1) is susceptible to a denial-of-service vulnerability (CVE-2026-49755) caused by unbounded archive and compression extraction, which an attacker can leverage by providing a malicious HTTP response with a crafted 'content-type' or 'content-encoding' header, leading to memory exhaustion and application crashes.","title":"Req Library Unbounded Archive/Compression Extraction Denial-of-Service","url":"https://feed.craftedsignal.io/briefs/2026-07-req-decompression-bomb/"}],"language":"en","title":"CraftedSignal Threat Feed - Req (\u003e= 0.1.0, \u003c 0.6.1)","version":"https://jsonfeed.org/version/1.1"}