PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-49755 wojtekmach CVE debrief

CVE-2026-49755 is a HIGH severity vulnerability in Req, a popular Erlang library. The vulnerability allows attacker-controlled HTTP servers to exhaust memory in a Req client via decompression-bomb response bodies. This occurs due to improper handling of highly compressed data, also known as data amplification. Req's default response pipeline includes steps to decode and decompress the body, which can lead to a significant increase in memory usage. An attacker can exploit this vulnerability by sending a specially crafted response with a small payload that expands to multiple gigabytes when decompressed, causing the BEAM process to crash.

Vendor
wojtekmach
Product
req
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-08
Original CVE updated
2026-06-09
Advisory published
2026-06-08
Advisory updated
2026-06-09

Who should care

Users of the Req library, particularly those who handle HTTP requests and responses, should be aware of this vulnerability. This includes developers and administrators who use Req in their applications, as well as security teams who monitor for potential vulnerabilities.

Technical summary

The vulnerability is caused by the improper handling of highly compressed data in Req's default response pipeline. Specifically, the `decode_body/1` and `decompress_body/1` steps in `lib/req/steps.ex` can lead to a significant increase in memory usage when dealing with compressed response bodies. The `decode_body/1` function dispatches on the server-supplied content-type and calls various extraction functions, such as `:zip.extract/2`, `:erl_tar.extract/2`, and `:erl_tar.extract/2` with `:compressed` option, which return the full decompressed archive contents as a list of tuples in memory. The `decompress_body/1` function walks the content-encoding header and chains decoders, which can lead to multiple layers of decompression without bound.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade to Req version 0.6.1 or later.
  • Disable the `decode_body/1` and `decompress_body/1` steps in the response pipeline if not required.
  • Implement additional validation and sanitization of response bodies to prevent decompression bombs.

Evidence notes

The CVE-2026-49755 vulnerability was reported by an unknown vendor and has a CVSS score of 8.2. The vulnerability affects Req versions from 0.1.0 to 0.6.0.

Official resources

CVE-2026-49755 was published on 2026-06-08T16:16:43.860Z and modified on 2026-06-09T15:20:13.097Z.