hex req vulnerabilities

Latest hex req CVEs

Newest publication first

1. CVE-2026-49755 Decompression bomb DoS in Req via auto-decoded archive and compressed response bodies

   Published 2026-06-08

   High·CVSS 8.2

   Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in wojtekmach Req allows attacker-controlled HTTP servers to exhaust memory in a Req client via decompression-bomb response bodies. Req's default response pipeline includes Req.Steps.decode_body/1 and...

2. CVE-2026-49756 Multipart form-data header injection in Req via unescaped name/filename/content_type

   Published 2026-06-08

   Low·CVSS 2.1

   Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in wojtekmach Req allows multipart parameter smuggling via attacker-influenced part metadata. Req.Utils.encode_form_part/2 in lib/req/utils.ex builds the per-part headers by interpolating the caller-suppli...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.