HIGH 7.5 GitHub
CVE-2026-53659
http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS
### Impact
`ServerFilters.GZip` and `RequestFilters.GunZip` (and the underlying `Gzip` functions used to decompress request bodies) did not impose any cap on the decompressed size. A small malicious gzip-encoded request body (on the order of kilobytes) could decompress to gigabytes, exhausting the JVM heap and denying service to other clients.
**Who is affected:** any http4k server that accepts gzip-encoded requests via `ServerFilters.GZip` or `RequestFilters.GunZip`. Exploitable by any unauth
Affected Products
- maven/org.http4k:http4k-core >= 5.0.0.0, < 5.42.0.0
- maven/org.http4k:http4k-core <= 4.48.2.0
- maven/org.http4k:http4k-core >= 6.0.0.0, < 6.49.0.0
References
- https://github.com/advisories/GHSA-g4w2-6h2r-3m3w
- https://github.com/http4k/http4k/security/advisories/GHSA-g4w2-6h2r-3m3w
- https://github.com/http4k/http4k/releases/tag/6.49.0.0
- https://github.com/advisories/GHSA-g4w2-6h2r-3m3w
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-08-17 via GitHub. Affected: maven/org.http4k:http4k-core >= 5.0.0.0, < 5.42.0.0, maven/org.http4k:http4k-core <= 4.48.2.0, maven/org.http4k:http4k-core >= 6.0.0.0, < 6.49.0.0.
vulnfeed aggregates 11052 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.