CVE-2026-49755: Req Package Suffers from Decompression Bomb DoS Vulnerability
Summary
CVE-2026-49755: Decompression bomb DoS in Req via auto-decoded archive and compressed response bodies. Affects req across 2 version ranges.
>= 0.1.0, < 0.6.1
>= e37753741cbdc725e6aba3d977b380163bfc0ecb, < 84977e5b1a83f26e749d55ad06e3625464af4e8d
Fixed in 0.6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Req package is a popular HTTP client library for Elixir, designed to simplify the process of making HTTP requests. It provides a straightforward API for handling requests and responses, including features for automatic decoding of response bodies. However, this convenience comes with a significant risk, as it is vulnerable to a decompression bomb denial-of-service (DoS) attack, which can exhaust memory resources.
Vulnerability Detail
The vulnerability arises from improper handling of highly compressed data, allowing attacker-controlled HTTP servers to send specially crafted responses that can exhaust memory in a Req client. The default response pipeline in Req includes steps that automatically decode and decompress response bodies without any size limitations. This means that a small response can inflate to a massive size, potentially crashing the application. The vulnerability affects Req versions from 0.1.0 to before 0.6.1, making it critical for users of these versions to take immediate action.
How To Fix
Minimum fixed version
0.6.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, you can disable Req's automatic body decoding for requests that fetch URLs influenced by attackers. Use the following code snippet to achieve this:
Req.new(url, decode_body: false)
Req.get!(url, decode_body: false)
To skip the content-encoding decompression pipeline, you can also pass raw: true:
Req.new(url, decode_body: false, raw: true)
Req.get!(url, decode_body: false, raw: true)
Conclusion
The CVE-2026-49755 vulnerability in the Req package poses a significant risk due to its potential for denial-of-service attacks through decompression bombs. Users are strongly advised to update to the latest version or implement the provided workarounds to mitigate the risk.
See every vulnerability recorded for req →
FAQ
A decompression bomb is a malicious file designed to exploit the decompression process, inflating a small file into a much larger size, which can overwhelm system resources.
If your application uses an affected version of the Req package, it may be susceptible to denial-of-service attacks, leading to crashes or unresponsive behavior.
The vulnerability affects Req versions from 0.1.0 to before 0.6.1.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for req.
