CVE-2026-53659
Received Received - Intake

Denial of Service in http4k via Gzip Decompression

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.49.0.0, ServerFilters.GZip, RequestFilters.GunZip, and the underlying Gzip request-body decompression functions impose no limit on decompressed size. An unauthenticated client can send a small gzip-encoded request body that expands to gigabytes, exhausting the JVM heap and denying service to other clients. The fix uses SizeLimitedInputStream to enforce a default 10 MiB limit, causes ServerFilters.GZip and RequestFilters.GunZip to return 413 Request Entity Too Large, and causes other decompression paths to throw SizeLimitExceededException. This issue is fixed in versions 4.51.0.0, 5.42.0.0, and 6.49.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-53659
EUVD
EUVD-2026-77694

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
http4k http4k to 4.51.0.0 (exc)
http4k http4k to 5.42.0.0 (exc)
http4k http4k to 6.49.0.0 (exc)
http4k http4k-core to 4.51.0.0 (exc)
http4k http4k-core to 5.42.0.0 (exc)
http4k http4k-core to 6.49.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the http4k library allows unauthenticated clients to send small gzip-encoded requests that decompress to gigabytes of data. The ServerFilters.GZip and RequestFilters.GunZip functions previously imposed no limit on decompressed size, causing JVM heap exhaustion and denial-of-service conditions for other clients.

Detection Guidance

Monitor for unusually large memory usage or JVM heap exhaustion when processing HTTP requests. Check for 413 Request Entity Too Large responses from http4k servers. Inspect network traffic for gzip-encoded requests that decompress to excessive sizes.

Impact Analysis

An attacker could exploit this to crash your http4k-based application by sending malicious gzip requests, leading to service outages. It may also cause high memory usage and slow performance for legitimate users due to resource exhaustion.

Compliance Impact

This vulnerability primarily impacts availability, which could lead to service disruptions. While not directly violating GDPR or HIPAA, prolonged outages may affect data access timeliness, potentially impacting compliance with availability requirements in these regulations.

Mitigation Strategies

Upgrade http4k to versions 4.51.0.0, 5.42.0.0, or 6.49.0.0 or later. Implement custom size-limited decompressors if upgrading is not immediately possible. Strip gzip support at the network edge to prevent malicious requests from reaching vulnerable filters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53659. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart