Read the docs
TI-2026-38700 Aliases CVE-2026-53659GHSA-g4w2-6h2r-3m3w

http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS

Priority MEDIUM 40CWE-409Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.49.0.0, ServerFilters.GZip, RequestFilters.GunZip, and the underlying Gzip request-body decompression functions impose no limit on decompressed size. An unauthenticated client can send a small gzip-encoded request body that expands to gigabytes, exhausting the JVM heap and denying service to other clients. The fix uses SizeLimitedInputStream to enforce a default 10 MiB limit, causes ServerFilters.GZip and RequestFilters.GunZip to return 413 Request Entity Too Large, and causes other decompression paths to throw SizeLimitExceededException. This issue is fixed in versions 4.51.0.0, 5.42.0.0, and 6.49.0.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0063 50th percentileScored 2026-11-07
Fix Fixed http4k (http4k): 4.51.0.0, 5.42.0.0, 6.49.0.0org.http4k:http4k-core (Maven): 6.49.0.0, 5.42.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
http4khttp4kbefore 4.51.0.0; 5.0.0.0 to before 5.42.0.0; 6.0.0.0 to before 6.49.0.04.51.0.0, 5.42.0.0, 6.49.0.0Patch availableCNA
—org.http4k:http4k-core (Maven)6.0.0.0 to before 6.49.0.06.49.0.0Patch availableGHSA-g4w2-6h2r-3m3w
—org.http4k:http4k-core (Maven)5.0.0.0 to before 5.42.0.05.42.0.0Patch availableGHSA-g4w2-6h2r-3m3w
—org.http4k:http4k-core (Maven)up to 4.48.2.0—No fix listedGHSA-g4w2-6h2r-3m3w
  • http4k Vendorhttp4k Affected before 4.51.0.0; 5.0.0.0 to before 5.42.0.0; 6.0.0.0 to before 6.49.0.0 Fixed in 4.51.0.0, 5.42.0.0, 6.49.0.0 Patch available CNA
  • org.http4k:http4k-core (Maven) Vendor— Affected 6.0.0.0 to before 6.49.0.0 Fixed in 6.49.0.0 Patch available GHSA-g4w2-6h2r-3m3w
  • org.http4k:http4k-core (Maven) Vendor— Affected 5.0.0.0 to before 5.42.0.0 Fixed in 5.42.0.0 Patch available GHSA-g4w2-6h2r-3m3w
  • org.http4k:http4k-core (Maven) Vendor— Affected up to 4.48.2.0 Fixed in — No fix listed GHSA-g4w2-6h2r-3m3w

Remediation

  • Fix · CNA http4k (http4k) Fixed in 4.51.0.0, 5.42.0.0, 6.49.0.0
  • Fix · GHSA-g4w2-6h2r-3m3w org.http4k:http4k-core (Maven) Fixed in 6.49.0.0 Advisory →
  • Fix · GHSA-g4w2-6h2r-3m3w org.http4k:http4k-core (Maven) Fixed in 5.42.0.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Fuse 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53659
  2. 2026-10-03 Alias added: GHSA-g4w2-6h2r-3m3w
  3. 2026-10-28 EPSS moved to the 50th–90th percentile

References

Other 5

  • TI-2024-36944 http4k has a potential XXE (XML External Entity Injection) vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2026-83683 Missing body integrity check in http4k Digest auth-int CVSS 4.0HIGH 8.2
  • TI-2026-39062 http4k: `DigestAuthProvider.verify` did not bind to request URI CVSS 3.1HIGH 8.1
  • TI-2026-64972 http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass CVSS 4.0HIGH 8.2
  • TI-2026-64881 http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage CVSS 4.0HIGH 8.3
  • TI-2026-83682 Path traversal in http4k ThymeleafTemplates lets attackers read files CVSS 4.0HIGH 8.2
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences