CVE-2026-49755 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-49755HIGH

wojtekmach req — Decompression bomb DoS in Req via auto-decoded archive and compressed response bodies

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   N   N   N   H    8.2   .0060   45.9     —

AFFECTED
  Product  Versions                                    Fixed
  req      0.1.0 –                                     —
  req      e37753741cbdc725e6aba3d977b380163bfc0ecb –  —

TIMELINE
  Jun 1   Reserved by EEF
  Jun 8   EXPLOIT PUBLISHED — CVE-2026-49755 (wojtekmach req). Public exploit reference added.
  Jun 8   Published (CNA: EEF)

CWE-409 · CNA: EEF · CVSS v4.0 · 4 references · NVD status: Analyzed

Description

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in wojtekmach Req allows attacker-controlled HTTP servers to exhaust memory in a Req client via decompression-bomb response bodies. Req's default response pipeline includes Req.Steps.decode_body/1 and Req.Steps.decompress_body/1 in lib/req/steps.ex. decode_body/1 dispatches on the server-supplied content-type (or URL extension) and calls :zip.extract(body, [:memory]) for application/zip, :erl_tar.extract({:binary, body}, [:memory]) for application/x-tar, and :erl_tar.extract({:binary, body}, [:memory, :compressed]) for application/gzip / .tgz. Each returns the full decompressed archive contents as a [{name, bytes}] list in memory, with no per-entry or total size cap. decompress_body/1 walks the content-encoding header and chains :zlib/:brotli/:ezstd decoders, so a response advertising content-encoding: gzip, gzip, gzip inflates through multiple layers without bound. Both steps are enabled by default, no caller opt-in is required, and the attacker controls the content-type and content-encoding headers on their own server (or on any host reached via Req's automatic redirect following). A sub-megabyte response can expand to multiple gigabytes on the victim, crashing the BEAM process. This issue affects req: from 0.1.0 before 0.6.1.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
June 1, 2026	Reserved	Reserved by EEF
June 8, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-49755 (wojtekmach req). Public exploit reference added.
June 8, 2026	Published	Published (CNA: EEF)

Affected

Affected products and packages — 2 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
wojtekmach	req	—	0.1.0	—
wojtekmach	req	—	e37753741cbdc725e6aba3d977b380163bfc0ecb	—

Weaknesses

CWE-409

References (4)

https://cna.erlef.org/cves/CVE-2026-49755.html [Third Party Advisory]
https://github.com/wojtekmach/req/commit/84977e5b1a83f26e749d55ad06e3625464af4e8d [Patch]
https://github.com/wojtekmach/req/security/advisories/GHSA-655f-mp8p-96gv [Vendor Advisory, Exploit, Patch]
https://osv.dev/vulnerability/EEF-CVE-2026-49755 [Third Party Advisory, Patch, Mitigation]

Authoritative record: CVE-2026-49755 at cve.org

Vendors: wojtekmach

Weaknesses: CWE-409

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-49755 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.