Hex/req CVE-2026-49755: high 7.5, EPSS 0.60%
Decompression bomb DoS in Req via auto-decoded archive and compressed response bodies
Action: Upgrade req to 0.6.1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.1.0 | 0.6.1 | - |
Fixed versions
| 0.6.1 |
Sources
- osv: EEF-CVE-2026-49755
- nvd: CVE-2026-49755
- https://github.com/wojtekmach/req/security/advisories/GHSA-655f-mp8p-96gv
- https://cna.erlef.org/cves/CVE-2026-49755.html
- https://github.com/wojtekmach/req/commit/84977e5b1a83f26e749d55ad06e3625464af4e8d
- https://hex.pm/packages/req
CVE-2026-49755 · published · modified · JSON