PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-49755 wojtekmach CVE debrief

CVE-2026-49755 is a HIGH severity vulnerability in Req, a popular Erlang library. The vulnerability allows attacker-controlled HTTP servers to exhaust memory in a Req client via decompression-bomb response bodies. This occurs due to improper handling of highly compressed data, also known as data amplification. Req's default response pipeline includes steps to decode and decompress the body, which can lead to a significant increase in memory usage. An attacker can exploit this vulnerability by sending a specially crafted response with a small payload that expands to multiple gigabytes when decompressed, causing the BEAM process to crash.

Vendor
wojtekmach
Product
req
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-08
Original CVE updated
2026-08-18
Advisory published
2026-06-08
Advisory updated
2026-08-18

Who should care

Users of the Req library, particularly those who handle HTTP requests and responses, should be aware of this vulnerability. This includes developers and administrators who use Req in their applications, as well as security teams who monitor for potential vulnerabilities.

Technical summary

The vulnerability is caused by the improper handling of highly compressed data in Req's default response pipeline. Specifically, the `decode_body/1` and `decompress_body/1` steps in `lib/req/steps.ex` can lead to a significant increase in memory usage when dealing with compressed response bodies. The `decode_body/1` function dispatches on the server-supplied content-type and calls various extraction functions, such as `:zip.extract/2`, `:erl_tar.extract/2`, and `:erl_tar.extract/2` with `:compressed` option, which return the full decompressed archive contents as a list of tuples in memory. The `decompress_body/1` function walks the content-encoding header and chains decoders, which can lead to multiple layers of decompression without bound.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade to Req version 0.6.1 or later.
  • Disable the `decode_body/1` and `decompress_body/1` steps in the response pipeline if not required.
  • Implement additional validation and sanitization of response bodies to prevent decompression bombs.

Evidence notes

The CVE-2026-49755 vulnerability was reported by an unknown vendor and has a CVSS score of 8.2. The vulnerability affects Req versions from 0.1.0 to 0.6.0.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-49755 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-49755

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-49755 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-49755

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://cna.erlef.org/cves/CVE-2026-49755.html

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://github.com/wojtekmach/req/commit/84977e5b1a83f26e749d55ad06e3625464af4e8d

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://github.com/wojtekmach/req/security/advisories/GHSA-655f-mp8p-96gv

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://osv.dev/vulnerability/EEF-CVE-2026-49755

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.