EUVD-2026-77694
GHSA-g4w2-6h2r-3m3w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable, no credentials needed, no interaction; impact is availability-only as heap exhaustion causes DoS with no data exposure.
Primary rating from Vendor (https://github.com/http4k/http4k).
CVSS VectorVendor: https://github.com/http4k/http4k
Lifecycle Timeline
3Blast Radius
ecosystem impact- 177 maven packages depend on org.http4k:http4k-core (144 direct, 33 indirect)
Ecosystem-wide dependent count for version 6.0.0.0.
DescriptionCVE.org
Impact
ServerFilters.GZip and RequestFilters.GunZip (and the underlying Gzip functions used to decompress request bodies) did not impose any cap on the decompressed size. A small malicious gzip-encoded request body (on the order of kilobytes) could decompress to gigabytes, exhausting the JVM heap and denying service to other clients.
Who is affected: any http4k server that accepts gzip-encoded requests via ServerFilters.GZip or RequestFilters.GunZip. Exploitable by any unauthenticated client. The vulnerability was introduced on 2017-08-01 (commit 2618fe08f9) and was present for ~9 years.
Patches
| Line | Fixed in | Edition |
|---|---|---|
| v6.x (Community) | 6.49.0.0 | Community |
| v5.x (LTS) | 5.42.0.0 | Enterprise - contact [enterprise@http4k.org](mailto:enterprise@http4k.org) |
| v4.x (LTS) | 4.51.0.0 | Enterprise - contact [enterprise@http4k.org](mailto:enterprise@http4k.org) |
The fix caps decompression at 10MB by default; oversized requests through ServerFilters.GZip / RequestFilters.GunZip now return 413 Request Entity Too Large, and decompressing elsewhere throws SizeLimitExceededException. The keyed hmacSHA256 helper and other safe paths are unaffected.
Workarounds
For deployments that cannot upgrade immediately:
- Replace the
GZip/GunZipfilters with custom versions that wrap the decompressedInputStreamin a size-limited reader, or - Strip gzip-encoded request support at the edge (CDN, reverse proxy, or load balancer).
References
- Vulnerability introduced:
2618fe08f9 - Fix release: v6.49.0.0
- Background: CWE-409 - Improper Handling of Highly Compressed Data
AnalysisAI
Unbounded gzip decompression in http4k's ServerFilters.GZip and RequestFilters.GunZip filters allows any unauthenticated remote client to exhaust JVM heap memory by sending a small (kilobyte-scale) gzip-encoded request body that decompresses to gigabytes - a classic compression bomb attack. All http4k servers using these filters across the v4.x, v5.x, and v6.x lines are affected; the flaw was silently present for approximately 9 years (since commit 2618fe08f9, 2017-08-01). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the http4k server has registered `ServerFilters.GZip` or `RequestFilters.GunZip` as part of its filter chain - this is a deliberate, opt-in configuration by the application developer, not a default behavior of the framework. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) accurately reflects a high-availability, low-complexity, unauthenticated network attack with no scope change or confidentiality/integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is upgrading `org.http4k:http4k-core` to version 6.49.0.0 (Community, v6.x line), 5.42.0.0 (Enterprise LTS v5.x), or 4.51.0.0 (Enterprise LTS v4.x - confirm availability with enterprise@http4k.org, as package metadata lists this as unfixed). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all servers and containerized deployments running http4k versions 4.x, 5.x, or 6.x, specifically identifying services with ServerFilters.GZip or RequestFilters.GunZip filters enabled. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today