Req (Elixir) EUVD-2026-35098

The victim application must use Req (versions 0.1.0-0.6.0) and issue an HTTP request whose final response is served by an attacker-controlled host - directly via an attacker-supplied URL or indirectly via Req's automatic redirect following. No authentication, user interaction, or non-default configuration is required on the Req side: decode_body/1 and decompress_body/1 are enabled by default, and the attacker controls both Content-Type (to trigger :zip/:erl_tar extraction) and Content-Encoding (to chain :zlib/:brotli/:ezstd decoders). Exploitation is limited to availability impact (BEAM process crash); it cannot be used for code execution or data disclosure, and applications that pass raw: true, that never fetch attacker-influenced URLs, or that have already upgraded to 0.6.1 are not exposed.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) reflects a network-reachable, unauthenticated, low-complexity issue with high availability impact (VA:H) and no confidentiality or integrity loss - consistent with a denial-of-service primitive that crashes the BEAM rather than achieving code execution. The AT:P (Attack Requirements: Present) qualifier captures the real-world constraint that the victim must actually issue an HTTP request to a server the attacker controls or can influence (including via Req's automatic redirect following). EPSS and KEV data were not provided, and no public exploit is identified at this time, so this is best treated as a credible but not yet actively-weaponized DoS bug. Risk is highest for services that use Req to fetch arbitrary user- or third-party-supplied URLs (webhook delivery, link unfurling, RSS/feed fetchers, SSRF-style proxy endpoints, server-side previews), where attacker URL control is realistic; closed-world, fixed-endpoint usage is materially lower risk.

A service uses Req to fetch a URL supplied by an untrusted user - for example, a webhook target, an OAuth callback metadata URL, or an open-graph preview fetcher. The attacker either points the service at their own host or sets up a redirect chain Req will follow; the malicious server responds with a ~500 KB payload and Content-Encoding: gzip, gzip, gzip (or Content-Type: application/zip wrapping a deeply nested bomb), causing the Req client to inflate the body to multiple gigabytes in memory and crash the BEAM VM, taking down the host service. No public PoC is referenced in the available data, but the technique is well-known and trivially reproducible from the advisory's description.