You are viewing this page in an unauthorized frame window.
This is a potential security issue, you are being redirected to
https://nvd.nist.gov
An official website of the United States government
Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock () or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
This CVE record has been marked for NVD enrichment efforts.
Description
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in wojtekmach Req allows attacker-controlled HTTP servers to exhaust memory in a Req client via decompression-bomb response bodies.
Req's default response pipeline includes Req.Steps.decode_body/1 and Req.Steps.decompress_body/1 in lib/req/steps.ex. decode_body/1 dispatches on the server-supplied content-type (or URL extension) and calls :zip.extract(body, [:memory]) for application/zip, :erl_tar.extract({:binary, body}, [:memory]) for application/x-tar, and :erl_tar.extract({:binary, body}, [:memory, :compressed]) for application/gzip / .tgz. Each returns the full decompressed archive contents as a [{name, bytes}] list in memory, with no per-entry or total size cap. decompress_body/1 walks the content-encoding header and chains :zlib/:brotli/:ezstd decoders, so a response advertising content-encoding: gzip, gzip, gzip inflates through multiple layers without bound.
Both steps are enabled by default, no caller opt-in is required, and the attacker controls the content-type and content-encoding headers on their own server (or on any host reached via Req's automatic redirect following). A sub-megabyte response can expand to multiple gigabytes on the victim, crashing the BEAM process.
This issue affects req: from 0.1.0 before 0.6.1.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [email protected].
Title: Req de wojtekmach, Description: La vulnerabilidad de manejo inadecuado de datos altamente comprimidos (amplificación de datos) en wojtekmach Req permite a los servidores HTTP controlados por el atacante agotar la memoria en un cliente Req mediante cuerpos de respuesta de bomba de descompresión.
La pipeline de respuesta predeterminada de Req incluye Req.Steps.decode_body/1 y Req.Steps.decompress_body/1 en lib/req/steps.ex. decode_body/1 despacha según el content-type proporcionado por el servidor (o extensión de URL) y llama a :zip.extract(body, [:memory]) para application/zip, a :erl_tar.extract({:binary, body}, [:memory]) para application/x-tar, y a :erl_tar.extract({:binary, body}, [:memory, :compressed]) para application/gzip / .tgz. Cada uno devuelve el contenido completo del archivo descomprimido como una lista [{name, bytes}] en memoria, sin límite de tamaño por entrada o total. decompress_body/1 recorre el encabezado content-encoding y encadena decodificadores :zlib/:brotli/:ezstd, por lo que una respuesta que anuncia content-encoding: gzip, gzip, gzip se infla a través de múltiples capas sin límite.
Ambos pasos están habilitados por defecto, no se requiere la participación del llamador, y el atacante controla los encabezados content-type y content-encoding en su propio servidor (o en cualquier host alcanzado a través del seguimiento automático de redirecciones de Req). Una respuesta de menos de un megabyte puede expandirse a múltiples gigabytes en la víctima, colapsando el proceso BEAM.
Este problema afecta a req: desde 0.1.0 antes de 0.6.1.
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in wojtekmach Req allows attacker-controlled HTTP servers to exhaust memory in a Req client via decompression-bomb response bodies.
Req's default response pipeline includes Req.Steps.decode_body/1 and Req.Steps.decompress_body/1 in lib/req/steps.ex. decode_body/1 dispatches on the server-supplied content-type (or URL extension) and calls :zip.extract(body, [:memory]) for application/zip, :erl_tar.extract({:binary, body}, [:memory]) for application/x-tar, and :erl_tar.extract({:binary, body}, [:memory, :compressed]) for application/gzip / .tgz. Each returns the full decompressed archive contents as a [{name, bytes}] list in memory, with no per-entry or total size cap. decompress_body/1 walks the content-encoding header and chains :zlib/:brotli/:ezstd decoders, so a response advertising content-encoding: gzip, gzip, gzip inflates through multiple layers without bound.
Both steps are enabled by default, no caller opt-in is required, and the attacker controls the content-type and content-encoding headers on their own server (or on any host reached via Req's automatic redirect following). A sub-megabyte response can expand to multiple gigabytes on the victim, crashing the BEAM process.
This issue affects req: from 0.1.0 before 0.6.1.
) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
